diff --git a/.github/workflows/backend-deploy.yml b/.github/workflows/backend-deploy.yml
index 19b0c873..823e0e4a 100644
--- a/.github/workflows/backend-deploy.yml
+++ b/.github/workflows/backend-deploy.yml
@@ -197,7 +197,7 @@ jobs:
 
       - name: Deploy to Fedora droplet
         if: ${{ steps.deploy-gate.outputs.enabled == 'true' }}
-        uses: appleboy/ssh-action@334f9259f2f8eb3376d33fa4c684fff373f2c2a6  # v0.1.10, SHA-pinned (holds the prod SSH key)
+        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2  # v0.1.10, SHA-pinned (holds the prod SSH key)
         env:
           REMOTE_IMAGE: ${{ needs.build.outputs.digest }}
           GHCR_USERNAME: ${{ github.repository_owner }}
@@ -398,7 +398,7 @@ jobs:
 
       - name: Verify deployment health
         if: ${{ steps.deploy-gate.outputs.enabled == 'true' }}
-        uses: appleboy/ssh-action@334f9259f2f8eb3376d33fa4c684fff373f2c2a6  # v0.1.10, SHA-pinned (holds the prod SSH key)
+        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2  # v0.1.10, SHA-pinned (holds the prod SSH key)
         with:
           host: ${{ env.DROPLET_HOST }}
           username: ${{ env.DROPLET_USER }}
diff --git a/.github/workflows/concierge-tests.yml b/.github/workflows/concierge-tests.yml
index 87e0bdff..7ae03a19 100644
--- a/.github/workflows/concierge-tests.yml
+++ b/.github/workflows/concierge-tests.yml
@@ -86,7 +86,7 @@ jobs:
         if: ${{ steps.deploy-gate.outputs.enabled == 'true' }}
         # SHA-pinned (supply-chain): this action receives the prod SSH deploy key, so a
         # moved/compromised tag must not be able to redirect it. 334f925 == v0.1.10.
-        uses: appleboy/ssh-action@334f9259f2f8eb3376d33fa4c684fff373f2c2a6
+        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2
         env:
           REPO: ${{ github.repository }}
           COMMIT_SHA: ${{ github.sha }}
diff --git a/.github/workflows/heartbeat-tests.yml b/.github/workflows/heartbeat-tests.yml
index f978370f..397acd17 100644
--- a/.github/workflows/heartbeat-tests.yml
+++ b/.github/workflows/heartbeat-tests.yml
@@ -98,7 +98,7 @@ jobs:
       # managed — see "Deploy" in Heartbeat/README.md.
       - name: Deploy heartbeat script to droplet
         if: ${{ steps.deploy-gate.outputs.enabled == 'true' }}
-        uses: appleboy/ssh-action@334f9259f2f8eb3376d33fa4c684fff373f2c2a6  # v0.1.10, SHA-pinned (holds the prod SSH key)
+        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2  # v0.1.10, SHA-pinned (holds the prod SSH key)
         env:
           REPO: ${{ github.repository }}
           COMMIT_SHA: ${{ github.sha }}