diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d81ee7756..43a58f001 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,7 +29,7 @@ jobs:
       # Everything the jars are built with. Gradle provisions no JDKs of its own —
       # auto-download is off in gradle.properties — so JDK21_HOME is the toolchain it reads.
       - name: Install JDK 21
-        uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1
+        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
         with:
           distribution: temurin
           java-version: '21'
@@ -97,7 +97,7 @@ jobs:
       # After GraalVM, so JAVA_HOME — and the Gradle daemon — is 21 like everywhere else, and
       # so the jars this job feeds into native-image are compiled at 21. GRAALVM_HOME survives.
       - name: Install JDK 21 for the jars
-        uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1
+        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
         with:
           distribution: temurin
           java-version: '21'
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 8024aadb7..5f910df92 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -27,7 +27,7 @@ jobs:
       # are provisioned by gradle-jdks (gradle/jdks/**), because gradle.properties
       # disables installation auto-detection.
       - name: Set up a bootstrap JDK
-        uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1
+        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
         with:
           distribution: temurin
           java-version: '21'
diff --git a/.github/workflows/dependency-submission.yml b/.github/workflows/dependency-submission.yml
index a235274e8..ae42cf43a 100644
--- a/.github/workflows/dependency-submission.yml
+++ b/.github/workflows/dependency-submission.yml
@@ -14,7 +14,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up a bootstrap JDK
-        uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4.9.1
+        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
         with:
           distribution: temurin
           java-version: '21'