diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 2a7ab28e..279480f3 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -134,7 +134,7 @@ jobs:
         uses: docker/setup-qemu-action@v3
 
       - name: Install cross
-        uses: taiki-e/install-action@6c6fd71fe4fb72c3697d269963d0e15df8adedad # v2.85.10
+        uses: taiki-e/install-action@37f7c5781271959fb65b6b35224e28652ff2b63d # v2.87.0
         with:
           tool: cross@0.2.5
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 57871838..27350f96 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1334,7 +1334,7 @@ jobs:
         uses: docker/setup-qemu-action@v3
 
       - name: Install cross
-        uses: taiki-e/install-action@6c6fd71fe4fb72c3697d269963d0e15df8adedad # v2.85.10
+        uses: taiki-e/install-action@37f7c5781271959fb65b6b35224e28652ff2b63d # v2.87.0
         with:
           tool: cross@0.2.5
 
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 8edfb66d..8f030523 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -114,7 +114,7 @@ jobs:
           
       - name: Install tarpaulin (stable, prebuilt pinned binary)
         if: matrix.rust == 'stable'
-        uses: taiki-e/install-action@6c6fd71fe4fb72c3697d269963d0e15df8adedad # v2.85.10
+        uses: taiki-e/install-action@37f7c5781271959fb65b6b35224e28652ff2b63d # v2.87.0
         with:
           # Pinned. Previously `cargo-tarpaulin` (i.e. @latest), which meant an upstream release
           # could break this job with no change on our side -- the same failure shape as the
@@ -348,7 +348,7 @@ jobs:
           key: ${{ runner.os }}-cargo-extcov-${{ matrix.shard }}-${{ steps.toolchain-fp.outputs.hash }}-${{ hashFiles('**/Cargo.lock', 'rust-toolchain.toml') }}
 
       - name: Install tarpaulin
-        uses: taiki-e/install-action@6c6fd71fe4fb72c3697d269963d0e15df8adedad # v2.85.10
+        uses: taiki-e/install-action@37f7c5781271959fb65b6b35224e28652ff2b63d # v2.87.0
         with:
           tool: cargo-tarpaulin@0.37.0
 
diff --git a/.github/workflows/security-critical-coverage.yml b/.github/workflows/security-critical-coverage.yml
index eb1fb8a3..dee7bd8d 100644
--- a/.github/workflows/security-critical-coverage.yml
+++ b/.github/workflows/security-critical-coverage.yml
@@ -40,7 +40,7 @@ jobs:
           key: ${{ runner.os }}-sec-cov-sig-${{ hashFiles('**/Cargo.lock') }}
 
       - name: Install cargo-tarpaulin
-        uses: taiki-e/install-action@6c6fd71fe4fb72c3697d269963d0e15df8adedad # v2.85.10
+        uses: taiki-e/install-action@37f7c5781271959fb65b6b35224e28652ff2b63d # v2.87.0
         with:
           # Pinned deliberately. `cargo-tarpaulin` (unpinned) resolves to @latest, so an upstream
           # release can break this job with no change on our side -- which is exactly how the
@@ -106,7 +106,7 @@ jobs:
           key: ${{ runner.os }}-sec-cov-tkeml-${{ hashFiles('**/Cargo.lock') }}
 
       - name: Install cargo-tarpaulin
-        uses: taiki-e/install-action@6c6fd71fe4fb72c3697d269963d0e15df8adedad # v2.85.10
+        uses: taiki-e/install-action@37f7c5781271959fb65b6b35224e28652ff2b63d # v2.87.0
         with:
           # Pinned deliberately. `cargo-tarpaulin` (unpinned) resolves to @latest, so an upstream
           # release can break this job with no change on our side -- which is exactly how the
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index f7705d7c..e731dd18 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -208,7 +208,7 @@ jobs:
           run-workspace-builds: "false"
       
       - name: Install cargo-outdated
-        uses: taiki-e/install-action@6c6fd71fe4fb72c3697d269963d0e15df8adedad # v2.85.10
+        uses: taiki-e/install-action@37f7c5781271959fb65b6b35224e28652ff2b63d # v2.87.0
         with:
           tool: cargo-outdated@0.19.0