diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 15550fb..ebfdb93 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -29,7 +29,7 @@ jobs:
           private-key: ${{ secrets.CI_APP_PRIVATE_KEY }}
           permission-contents: write # push the `release/vX.Y.Z` branch and delete superseded ones
           permission-pull-requests: write # create a release PR, update its body, close superseded PRs
-      - uses: danielroe/uppt/pr@7bcfb5397c37202ef882363f755423130419d28a # v0.5.5
+      - uses: danielroe/uppt/pr@6ec27140623aa835e362f866d8ab0018ab057f4d # v0.6.11
         with:
           token: ${{ steps.app-token.outputs.token }}
           packages: |
@@ -62,7 +62,7 @@ jobs:
       contents: write # push the `vX.Y.Z` tag and create the GitHub release
       actions: write # `gh workflow run release.yml --ref vX.Y.Z` chained dispatch
     steps:
-      - uses: danielroe/uppt/release@7bcfb5397c37202ef882363f755423130419d28a # v0.5.5
+      - uses: danielroe/uppt/release@6ec27140623aa835e362f866d8ab0018ab057f4d # v0.6.11
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           packages: |
@@ -101,7 +101,7 @@ jobs:
           node-version: 24
           package-manager-cache: false
       - id: pack
-        uses: danielroe/uppt/pack@7bcfb5397c37202ef882363f755423130419d28a # v0.5.5
+        uses: danielroe/uppt/pack@6ec27140623aa835e362f866d8ab0018ab057f4d # v0.6.11
         with:
           install: false
           packages: |
@@ -132,6 +132,6 @@ jobs:
       id-token: write # OIDC claim for npm trusted publisher
     environment: npm # must match the trusted-publisher entry on npmjs.com
     steps:
-      - uses: danielroe/uppt/publish@7bcfb5397c37202ef882363f755423130419d28a # v0.5.5
+      - uses: danielroe/uppt/publish@6ec27140623aa835e362f866d8ab0018ab057f4d # v0.6.11
         with:
           files: ${{ needs.pack.outputs.files }}