diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml
index 5e643a4..e36c5a4 100644
--- a/.github/workflows/bench.yml
+++ b/.github/workflows/bench.yml
@@ -95,7 +95,7 @@ jobs:
       # sample this one runner, so both read the same resolved port.
       - name: resolve redis port
         run: echo "REDIS_URL=redis://localhost:${{ job.services.redis.ports['6379'] }}/0" >> "$GITHUB_ENV"
-      - uses: ruby/setup-ruby@e8944e80fb94b20106697132f8c20c665fab29e9 # v1
+      - uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1
         with:
           ruby-version: "4.0"
           bundler-cache: true
diff --git a/.github/workflows/ecosystem.yml b/.github/workflows/ecosystem.yml
index 40479aa..0399873 100644
--- a/.github/workflows/ecosystem.yml
+++ b/.github/workflows/ecosystem.yml
@@ -78,7 +78,7 @@ jobs:
       # the `job` context is unavailable there.
       - name: resolve redis port
         run: echo "ECOSYSTEM_REDIS_URL=redis://localhost:${{ job.services.redis.ports['6379'] }}/15" >> "$GITHUB_ENV"
-      - uses: ruby/setup-ruby@e8944e80fb94b20106697132f8c20c665fab29e9 # v1
+      - uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1
         with:
           # NOT the newest Ruby, deliberately. This job's subject is third-party
           # gems at pinned upstream SHAs, so it has to run a Ruby *they* support:
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index e9b7a96..a237121 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -42,7 +42,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: ruby/setup-ruby@e8944e80fb94b20106697132f8c20c665fab29e9 # v1
+      - uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1
         with:
           # Pinned below the newest Ruby on purpose: this job builds docs (YARD)
           # and makes no statement about which Ruby Wurk supports, so there is
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9157052..bacb08a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -55,7 +55,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: ruby/setup-ruby@e8944e80fb94b20106697132f8c20c665fab29e9 # v1
+      - uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1
         with:
           ruby-version: "3.4"
           # No bundle needed: version.rb and release_helpers.rb are dependency-free.
@@ -107,7 +107,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: ruby/setup-ruby@e8944e80fb94b20106697132f8c20c665fab29e9 # v1
+      - uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1
         with:
           # Pinned below the newest Ruby on purpose: the built .gem is pure Ruby
           # and identical whichever interpreter packs it, so this job carries the
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 52c1efa..d41b2d5 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -139,7 +139,7 @@ jobs:
       - name: resolve redis port
         if: env.RUN == 'true'
         run: echo "REDIS_URL=redis://localhost:${{ job.services.redis.ports['6379'] }}/0" >> "$GITHUB_ENV"
-      - uses: ruby/setup-ruby@e8944e80fb94b20106697132f8c20c665fab29e9 # v1
+      - uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1
         if: env.RUN == 'true'
         with:
           ruby-version: ${{ env.RUBY_VERSION }}
@@ -258,7 +258,7 @@ jobs:
       # STEP, not job-level `env:` — see the `test` job above.
       - name: resolve redis port
         run: echo "REDIS_URL=redis://localhost:${{ job.services.redis.ports['6379'] }}/0" >> "$GITHUB_ENV"
-      - uses: ruby/setup-ruby@e8944e80fb94b20106697132f8c20c665fab29e9 # v1
+      - uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1
         with:
           ruby-version: "4.0"
           bundler-cache: true
@@ -363,7 +363,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: ruby/setup-ruby@e8944e80fb94b20106697132f8c20c665fab29e9 # v1
+      - uses: ruby/setup-ruby@14594264cd68ce8a2345dd349bc3d138a4ef85c8 # v1
         with:
           ruby-version: "4.0"
           bundler-cache: true