diff --git a/.github/workflows/crates.yml b/.github/workflows/crates.yml
index 20e4d5d..56a9d0b 100644
--- a/.github/workflows/crates.yml
+++ b/.github/workflows/crates.yml
@@ -81,7 +81,7 @@ jobs:
         # Without a matching trusted publisher (a crate's first version, or not configured yet) the
         # exchange fails: then the CARGO_REGISTRY_TOKEN secret is used, if there is one.
         continue-on-error: ${{ env.HAS_TOKEN_SECRET == 'true' }}
-        uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
+        uses: rust-lang/crates-io-auth-action@3268eb413133e2960fa4ae0e963ca76380c54cd9 # v1.0.6
       - name: Publish
         if: steps.pending.outputs.crates != ''
         env: