diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 6d45c85..ba2625b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -71,7 +71,7 @@ jobs:
       # Runs each test in its own process, so a hang names the test that hung
       # instead of timing the whole job out. Third-party action: pinned to a
       # commit SHA (dependabot keeps it fresh).
-      - uses: taiki-e/install-action@e407f7bafb71fd004bc5c2da3032e5470cbb6ef0 # v2
+      - uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2
         with:
           tool: cargo-nextest
 
@@ -165,7 +165,7 @@ jobs:
         with:
           key: ${{ matrix.target }}
       # Third-party action: pinned to a commit SHA (dependabot keeps it fresh).
-      - uses: taiki-e/install-action@e407f7bafb71fd004bc5c2da3032e5470cbb6ef0 # v2
+      - uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2
         with:
           tool: cargo-nextest
 
@@ -204,7 +204,7 @@ jobs:
       # deny.toml. The released binary rather than the Docker action, whose
       # image build pulls from Docker Hub and hits its anonymous rate limit
       # on shared runners.
-      - uses: taiki-e/install-action@e407f7bafb71fd004bc5c2da3032e5470cbb6ef0 # v2
+      - uses: taiki-e/install-action@ab6895351a88b908e96a4697860d4ffea5e57dbe # v2
         with:
           tool: cargo-deny
       - name: Check advisories