diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 090f609a..e1493395 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -29,7 +29,7 @@ jobs:
       # and `git/refs/tags/<tag>` would return its tag-object SHA, not the commit).
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
         with:
           version: 11.10.0
 
@@ -167,7 +167,7 @@ jobs:
       # SHA-pinned per the repo-wide policy documented in the `build` job above.
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
         with:
           version: 11.10.0
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index d9e3a50b..cc7a338e 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -62,7 +62,7 @@ jobs:
             exit 1
           fi
 
-      - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
+      - uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
         with:
           version: 11.10.0
 
@@ -194,14 +194,14 @@ jobs:
       # an unattested artifact, and so the attested digest equals the bytes
       # handed to Marketplace + Open VSX.
       - name: Attest build provenance
-        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-path: extension.vsix
 
       # Bind the SBOM to the same .vsix digest (SBOM mode = sbom-path) so a
       # consumer can retrieve the dependency graph for the artifact they got.
       - name: Attest SBOM
-        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-path: extension.vsix
           sbom-path: sbom.spdx.json