diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml
index 5663e34..18f41af 100644
--- a/.github/workflows/pr.yaml
+++ b/.github/workflows/pr.yaml
@@ -32,7 +32,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up just
-        uses: cerbos/actions/install-tools@e0522b0533b6679733f18d606638b0d91ffcf39d # main
+        uses: cerbos/actions/install-tools@46d5ebb4863c5923349d640fdf918185ec951a09 # main
         with:
           tools: just
 
@@ -65,7 +65,7 @@ jobs:
           go-version-file: go.mod
 
       - name: Set up just
-        uses: cerbos/actions/install-tools@e0522b0533b6679733f18d606638b0d91ffcf39d # main
+        uses: cerbos/actions/install-tools@46d5ebb4863c5923349d640fdf918185ec951a09 # main
         with:
           tools: just
 
@@ -73,10 +73,10 @@ jobs:
         run: just lint-modernize
 
       - name: golangci-lint
-        uses: cerbos/actions/golangci-lint@e0522b0533b6679733f18d606638b0d91ffcf39d # main
+        uses: cerbos/actions/golangci-lint@46d5ebb4863c5923349d640fdf918185ec951a09 # main
 
       - name: Check repo status
-        uses: cerbos/actions/check-repo-status@e0522b0533b6679733f18d606638b0d91ffcf39d # main
+        uses: cerbos/actions/check-repo-status@46d5ebb4863c5923349d640fdf918185ec951a09 # main
 
   buf:
     name: Proto check
@@ -90,4 +90,4 @@ jobs:
           persist-credentials: false
 
       - name: Lint protos
-        uses: cerbos/actions/buf@e0522b0533b6679733f18d606638b0d91ffcf39d # main
+        uses: cerbos/actions/buf@46d5ebb4863c5923349d640fdf918185ec951a09 # main
diff --git a/.github/workflows/publish.yaml b/.github/workflows/publish.yaml
index 5bc7ecf..3dcb241 100644
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -21,6 +21,6 @@ jobs:
           persist-credentials: false
 
       - name: Push to BSR
-        uses: cerbos/actions/buf@e0522b0533b6679733f18d606638b0d91ffcf39d # main
+        uses: cerbos/actions/buf@46d5ebb4863c5923349d640fdf918185ec951a09 # main
         with:
           token: ${{ secrets.BUF_TOKEN }}
diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml
index ae29957..66f30fc 100644
--- a/.github/workflows/zizmor.yaml
+++ b/.github/workflows/zizmor.yaml
@@ -27,4 +27,4 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: cerbos/actions/lint-actions@e0522b0533b6679733f18d606638b0d91ffcf39d # main
+        uses: cerbos/actions/lint-actions@46d5ebb4863c5923349d640fdf918185ec951a09 # main
diff --git a/tools/go.mod b/tools/go.mod
index 18cbc10..92fac72 100644
--- a/tools/go.mod
+++ b/tools/go.mod
@@ -6,7 +6,7 @@ toolchain go1.26.3
 
 require (
 	connectrpc.com/connect v1.19.2
-	github.com/cerbos/actions v0.0.0-20260515102558-e0522b0533b6
+	github.com/cerbos/actions v0.0.0-20260525162116-46d5ebb4863c
 	github.com/cerbos/protoc-gen-go-hashpb v0.5.0
 	github.com/planetscale/vtprotobuf v0.6.1-0.20250313105119-ba97887b0a25
 	github.com/vektra/mockery/v3 v3.7.0
diff --git a/tools/go.sum b/tools/go.sum
index 6239d8c..f4322fb 100644
--- a/tools/go.sum
+++ b/tools/go.sum
@@ -4,8 +4,8 @@ github.com/bitfield/gotestdox v0.2.2 h1:x6RcPAbBbErKLnapz1QeAlf3ospg8efBsedU93CD
 github.com/bitfield/gotestdox v0.2.2/go.mod h1:D+gwtS0urjBrzguAkTM2wodsTQYFHdpx8eqRJ3N+9pY=
 github.com/brunoga/deep v1.3.1 h1:bSrL6FhAZa6JlVv4vsi7Hg8SLwroDb1kgDERRVipBCo=
 github.com/brunoga/deep v1.3.1/go.mod h1:GDV6dnXqn80ezsLSZ5Wlv1PdKAWAO4L5PnKYtv2dgaI=
-github.com/cerbos/actions v0.0.0-20260515102558-e0522b0533b6 h1:wCwPJflxb7n25PTiBVRZA00ucbpysPjlW++BCMJdzf0=
-github.com/cerbos/actions v0.0.0-20260515102558-e0522b0533b6/go.mod h1:eExHaISF7LBw4Q0GkGL5Xj8ac6l7V7m910yRnj2Mx4c=
+github.com/cerbos/actions v0.0.0-20260525162116-46d5ebb4863c h1:LMge+U87pGMt9D41WLkIW22YQdymZnNr9p7BrvbmA8E=
+github.com/cerbos/actions v0.0.0-20260525162116-46d5ebb4863c/go.mod h1:XCveH9gEaqWxhsZvpFRgnRwfvlGXZNNez5THdsxdycc=
 github.com/cerbos/protoc-gen-go-hashpb v0.5.0 h1:eRxAGfPtAPIwuEu/5TwUM//iE2DLxPRv6MYcKTk+Vqg=
 github.com/cerbos/protoc-gen-go-hashpb v0.5.0/go.mod h1:2xx4aHivI/LQZA2iusGwPwsg/EOKxRX59BZZbojy2OM=
 github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=