diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index e63e36195e..be3ad45d9f 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -23,7 +23,7 @@ jobs:
           lfs: true
 
     - name: set up JDK 17
-      uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
+      uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       # gh api repos/actions/setup-java/commits/v5 --jq '.sha'
       with:
         distribution: temurin
diff --git a/.github/workflows/diffuse.yml b/.github/workflows/diffuse.yml
index d284a1d920..790f744245 100644
--- a/.github/workflows/diffuse.yml
+++ b/.github/workflows/diffuse.yml
@@ -23,7 +23,7 @@ jobs:
         ref: ${{ github.event.pull_request.base.sha }}
 
     - name: set up JDK 17
-      uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
+      uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
       # gh api repos/actions/setup-java/commits/v5 --jq '.sha'
       with:
         distribution: temurin
@@ -47,7 +47,7 @@ jobs:
 
     - name: Cache base apk
       id: cache-base
-      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v5
       # gh api repos/actions/cache/commits/v5 --jq '.sha'
       with:
         path: diffuse-base.apk