diff --git a/.github/workflows/flake-check.yml b/.github/workflows/flake-check.yml
index 47b3c66..13716bb 100644
--- a/.github/workflows/flake-check.yml
+++ b/.github/workflows/flake-check.yml
@@ -18,7 +18,7 @@ jobs:
       contents: read # strictest possible
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6.0.2 (Jan 2026)
-      - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22 (Mar 2026)
+      - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa # v22 (Mar 2026)
       - name: format check (treefmt)
         # Fast-fail on unformatted files (nixfmt + shfmt) before the heavy build. `nix flake
         # check` also enforces this via checks.formatting; this step just surfaces it sooner.
diff --git a/.github/workflows/flake-update.yml b/.github/workflows/flake-update.yml
index 13b954f..05ce9dc 100644
--- a/.github/workflows/flake-update.yml
+++ b/.github/workflows/flake-update.yml
@@ -31,7 +31,7 @@ jobs:
           app-id: ${{ vars.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v6.0.2 (Jan 2026)
-      - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22 (Mar 2026)
+      - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa # v22 (Mar 2026)
       - name: nix flake update
         run: nix flake update
       - name: create pull request
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 97c7d0e..9843a8b 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -32,7 +32,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: DeterminateSystems/nix-installer-action@ef8a148080ab6020fd15196c2084a2eea5ff2d25 # v22
+      - uses: DeterminateSystems/nix-installer-action@3138316df39ed29be04236d7ffc686fa525866aa # v23
       - name: build docs site
         run: nix build .#docs -L
       - name: stage site (deref the store symlink)