diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 428e657..76e7c1e 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -28,7 +28,7 @@ jobs:
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
 
       - name: Install cargo-llvm-cov
-        uses: taiki-e/install-action@deb6b2ccc5004cae3fb73fe4dcd60492786cb1dd # cargo-llvm-cov
+        uses: taiki-e/install-action@166cdddc0349c6f3c1da17f66a8fc88ec3bc4dd5 # cargo-llvm-cov
 
       - name: Run unit tests under coverage instrumentation
         run: cargo llvm-cov --no-report --all-features --lib --verbose
diff --git a/.github/workflows/mutants.yml b/.github/workflows/mutants.yml
index 8c2ad46..2e95380 100644
--- a/.github/workflows/mutants.yml
+++ b/.github/workflows/mutants.yml
@@ -34,7 +34,7 @@ jobs:
       - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
 
       - name: Install cargo-mutants
-        uses: taiki-e/install-action@deb6b2ccc5004cae3fb73fe4dcd60492786cb1dd # cargo-mutants
+        uses: taiki-e/install-action@2ffdc177c283758d9c1f0f9563d70cce8bc9c576 # cargo-mutants
 
       # Scoped to the parser/codec modules (highest payoff for catching
       # tests that run code without asserting on it). The full set currently