diff --git a/.github/workflows/build-mobile.yml b/.github/workflows/build-mobile.yml
index 625232c0e..bdb4f7872 100644
--- a/.github/workflows/build-mobile.yml
+++ b/.github/workflows/build-mobile.yml
@@ -226,7 +226,7 @@ jobs:
 
       - name: Setup Java
         if: ${{ matrix.platform == 'android' }}
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
         with:
           distribution: temurin
           java-version: 17
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a7f43ae3c..44dd81d4e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -42,7 +42,7 @@ jobs:
 
       - name: Setup Rust
         id: setup-rust
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@v2
         with:
           rustflags: "" # keep build.rustflags; the -D warnings default belongs to the Rust job's clippy call
         background: true
@@ -138,7 +138,7 @@ jobs:
 
       - name: Setup Rust
         id: setup-rust
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@v2
         with:
           rustflags: ""
         background: true
@@ -266,7 +266,7 @@ jobs:
 
       # rustfmt and clippy come from rust-toolchain.toml's components.
       - name: Setup Rust
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@v2
         with:
           rustflags: ""
 
diff --git a/.github/workflows/release-desktop.yml b/.github/workflows/release-desktop.yml
index d6781062c..5e8aa9ff3 100644
--- a/.github/workflows/release-desktop.yml
+++ b/.github/workflows/release-desktop.yml
@@ -123,7 +123,7 @@ jobs:
           - name: Upload GitHub Release assets
             id: release-assets
             if: ${{ github.event_name == 'push' || inputs.dry_run == false }}
-            uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
+            uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
             with:
               tag_name: ${{ steps.meta.outputs.tag }}
               # release-please creates this draft before the tag push. Keep it private while the