diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
index 9b9f012..0820163 100644
--- a/.github/workflows/build-and-test.yml
+++ b/.github/workflows/build-and-test.yml
@@ -44,7 +44,7 @@ jobs:
           java-version: '21'
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
+        uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
 
       # One invocation rather than three steps, and `--continue` so that a
       # formatting slip does not hide a lint error found later in the run.
@@ -93,7 +93,7 @@ jobs:
           java-version: '21'
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
+        uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
 
       # Robolectric fetches an `android-all-instrumented` jar per emulated SDK
       # at *test* runtime, through Maven and not through Gradle — so the Gradle