diff --git a/.github/workflows/ai-testgen.yml b/.github/workflows/ai-testgen.yml
index 95b6614..5bb5e44 100644
--- a/.github/workflows/ai-testgen.yml
+++ b/.github/workflows/ai-testgen.yml
@@ -30,7 +30,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up JDK 25 (Temurin)
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: temurin
           java-version: '25'
@@ -50,7 +50,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up JDK 25 (Temurin)
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: temurin
           java-version: '25'
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index 64a40ed..19903b6 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -31,7 +31,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up JDK 25 (Temurin)
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: temurin
           java-version: '25'
diff --git a/.github/workflows/legacy-ci.yml b/.github/workflows/legacy-ci.yml
index 1b20667..5d06009 100644
--- a/.github/workflows/legacy-ci.yml
+++ b/.github/workflows/legacy-ci.yml
@@ -36,7 +36,7 @@ jobs:
           ./scripts/check-schema-drift.sh
 
       - name: Set up JDK 8 (Temurin)
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: temurin
           java-version: '8'
@@ -47,7 +47,7 @@ jobs:
 
       # ---- characterization gate (armed since stage-1-safety-net) ----
       - name: Set up JDK 25 (Temurin) for characterization
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: temurin
           java-version: '25'
diff --git a/.github/workflows/modern-ci.yml b/.github/workflows/modern-ci.yml
index 46f57bf..da880b1 100644
--- a/.github/workflows/modern-ci.yml
+++ b/.github/workflows/modern-ci.yml
@@ -35,7 +35,7 @@ jobs:
           echo "jdk=$v" >> "$GITHUB_OUTPUT"
 
       - name: Set up JDK ${{ steps.jdk.outputs.jdk }} (Temurin)
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: temurin
           java-version: ${{ steps.jdk.outputs.jdk }}
@@ -46,7 +46,7 @@ jobs:
 
       # ---- equivalence gate: characterization vs the MODERN stand ----
       - name: Set up JDK 25 (Temurin) for characterization
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: temurin
           java-version: '25'