diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c3e7249..0930b58 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,7 +24,7 @@ jobs:
       # Nucleus's own setup action: installs the JetBrains Runtime and Gradle. We pin the
       # JBR to 25. No packaging tools or Node needed for a plain build + test.
       # Pin @main to a released Nucleus tag once you've settled on a version.
-      - uses: NucleusFramework/Nucleus/.github/actions/setup-nucleus@1f7422bf3da14bb83b7923c3fafd1e5924ed483a # main
+      - uses: NucleusFramework/Nucleus/.github/actions/setup-nucleus@67e9920f171a6d569e520d95b53c8e594b44a4d4 # main
         with:
           java-version: '25'
           packaging-tools: 'false'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 056c9a3..d30f19b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -36,7 +36,7 @@ jobs:
       # prerequisites (build.gradle enables graalvm { }). The GraalVM JDK itself is
       # auto-provisioned by the Nucleus Gradle plugin.
       # Pin @main to a released Nucleus tag once you've settled on a version.
-      - uses: NucleusFramework/Nucleus/.github/actions/setup-nucleus@1f7422bf3da14bb83b7923c3fafd1e5924ed483a # main
+      - uses: NucleusFramework/Nucleus/.github/actions/setup-nucleus@67e9920f171a6d569e520d95b53c8e594b44a4d4 # main
         with:
           java-version: '25'
           packaging-tools: 'true'
@@ -139,7 +139,7 @@ jobs:
       # It shells out to `gh` but declares no token input and sets no GH_TOKEN itself, so the
       # calling workflow has to provide one or every gh call fails with "set the GH_TOKEN
       # environment variable". The job's `contents: write` permission covers what it needs.
-      - uses: NucleusFramework/Nucleus/.github/actions/publish-release@1f7422bf3da14bb83b7923c3fafd1e5924ed483a # main
+      - uses: NucleusFramework/Nucleus/.github/actions/publish-release@67e9920f171a6d569e520d95b53c8e594b44a4d4 # main
         env:
           GH_TOKEN: ${{ github.token }}
           # This job never checks the repo out (it only downloads artifacts), so `gh` has no git