diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 452eb37..c545073 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -22,7 +22,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: nix-forge/ci/actions/setup-nix@32dec0910e46dda3568ef5a494ed5fb6a9a08f31 # v2.10.0
+      - uses: nix-forge/ci/actions/setup-nix@ab8e486d3d1c48edd116578e097a46eb0c8f5097 # v2.12.0
       - name: Test shared actions and check workflow security
         run: nix flake check --print-build-logs
       - name: Test attribute discovery against real Nix
@@ -47,4 +47,4 @@ jobs:
       actions: write # Notify the trusted default-branch reconciler.
     steps:
       - name: Notify trusted queue reconciler
-        uses: nix-forge/ci/actions/queue-completion@32dec0910e46dda3568ef5a494ed5fb6a9a08f31 # v2.10.0
+        uses: nix-forge/ci/actions/queue-completion@ab8e486d3d1c48edd116578e097a46eb0c8f5097 # v2.12.0
diff --git a/.github/workflows/dco.yml b/.github/workflows/dco.yml
index c44c01d..74bd9e6 100644
--- a/.github/workflows/dco.yml
+++ b/.github/workflows/dco.yml
@@ -149,4 +149,4 @@ jobs:
       actions: write # Notify the trusted default-branch reconciler.
     steps:
       - name: Notify trusted queue reconciler
-        uses: nix-forge/ci/actions/queue-completion@32dec0910e46dda3568ef5a494ed5fb6a9a08f31 # v2.10.0
+        uses: nix-forge/ci/actions/queue-completion@ab8e486d3d1c48edd116578e097a46eb0c8f5097 # v2.12.0
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index de84532..5cfdf11 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -36,4 +36,4 @@ jobs:
       actions: write # Dispatch trusted queue validation.
     steps:
       - name: Notify trusted queue reconciler
-        uses: nix-forge/ci/actions/queue-completion@32dec0910e46dda3568ef5a494ed5fb6a9a08f31 # v2.10.0
+        uses: nix-forge/ci/actions/queue-completion@ab8e486d3d1c48edd116578e097a46eb0c8f5097 # v2.12.0
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index be6602a..393d930 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -24,7 +24,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: nix-forge/ci/actions/setup-nix@32dec0910e46dda3568ef5a494ed5fb6a9a08f31 # v2.10.0
+      - uses: nix-forge/ci/actions/setup-nix@ab8e486d3d1c48edd116578e097a46eb0c8f5097 # v2.12.0
         with:
           cache: "false"
           cache-scope: documentation
diff --git a/.github/workflows/reconcile-merge-queue.yml b/.github/workflows/reconcile-merge-queue.yml
index a49c8ec..9cb90c5 100644
--- a/.github/workflows/reconcile-merge-queue.yml
+++ b/.github/workflows/reconcile-merge-queue.yml
@@ -32,7 +32,7 @@ jobs:
       statuses: write # Report verified queue job results.
     steps:
       - name: Reconcile verified automation
-        uses: nix-forge/ci/actions/reconcile-queue@32dec0910e46dda3568ef5a494ed5fb6a9a08f31 # v2.10.0
+        uses: nix-forge/ci/actions/reconcile-queue@ab8e486d3d1c48edd116578e097a46eb0c8f5097 # v2.12.0
         with:
           workflows: '["ci.yml", "dco.yml", "fuzz.yml"]'
           base-sha-workflows: '["dco.yml"]'
diff --git a/.github/workflows/slsa-nix-seal-release.yml b/.github/workflows/slsa-nix-seal-release.yml
index 68dc88e..34d6191 100644
--- a/.github/workflows/slsa-nix-seal-release.yml
+++ b/.github/workflows/slsa-nix-seal-release.yml
@@ -48,7 +48,7 @@ jobs:
           tag_commit="$(git rev-parse "${GITHUB_REF}^{commit}")"
           [[ "$tag_commit" == "$SOURCE_COMMIT" ]]
       - name: Set up Nix without a shared release cache
-        uses: nix-forge/ci/actions/setup-nix@32dec0910e46dda3568ef5a494ed5fb6a9a08f31 # v2.10.0
+        uses: nix-forge/ci/actions/setup-nix@ab8e486d3d1c48edd116578e097a46eb0c8f5097 # v2.12.0
         with:
           cache: 'false'
           cache-scope: release-build