diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f8745c1..5dceeb2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,7 +18,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: DeterminateSystems/determinate-nix-action@61cbfe2efc2d4e7a8a6d56967c3c1058e846c858 # v3.21.9
+      - uses: DeterminateSystems/determinate-nix-action@527f17dd63d2d60d3e5552934bc84b9a33a14d11 # v3.22.2
         with:
           extra-conf: |
             extra-substituters = https://cache.secbear.dev https://secbear-cache-niks3.fly.dev
diff --git a/.github/workflows/niks3-push.yml b/.github/workflows/niks3-push.yml
index e6efaf5..f2da19c 100644
--- a/.github/workflows/niks3-push.yml
+++ b/.github/workflows/niks3-push.yml
@@ -46,7 +46,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install Nix
-        uses: DeterminateSystems/determinate-nix-action@61cbfe2efc2d4e7a8a6d56967c3c1058e846c858 # v3.21.9
+        uses: DeterminateSystems/determinate-nix-action@527f17dd63d2d60d3e5552934bc84b9a33a14d11 # v3.22.2
         with:
           extra-conf: |
             extra-substituters = ${{ inputs.substituter-url }}