diff --git a/.github/actions/setup-tools/action.yml b/.github/actions/setup-tools/action.yml
index c289413..45252c1 100644
--- a/.github/actions/setup-tools/action.yml
+++ b/.github/actions/setup-tools/action.yml
@@ -14,7 +14,7 @@ runs:
       env:
         TOOLS: ${{ inputs.tools }}
       run: echo "MISE_ENABLE_TOOLS=$TOOLS" >>"$GITHUB_ENV" # zizmor: ignore[github-env] the callers' `tools:` literals, never event data
-    - uses: jdx/mise-action@6be3c7ed4c21d4f76b208d351d95aac273ebb76d # v5.2.4
+    - uses: jdx/mise-action@f5be966e4a917d54244728e6a5fdcd1d93a35e6c # v5.2.6
       with:
         # opinion: `latest` resolves every run, so a cache saves little and
         # could hand back an older match
diff --git a/.github/workflows/release-plz.yml b/.github/workflows/release-plz.yml
index 79e8b59..b0c35ef 100644
--- a/.github/workflows/release-plz.yml
+++ b/.github/workflows/release-plz.yml
@@ -34,7 +34,7 @@ jobs:
           persist-credentials: false
       - uses: pixtuoid/.github/.github/actions/setup-rust@main
       - id: release-plz
-        uses: release-plz/action@f67a7e724bdad4a0f6875f186060a0ca2770d76c # v0.5.147
+        uses: release-plz/action@66b324fd6c72d05d2a08568492ecdd62bfb8a62b # v0.5.148
         with:
           command: release-pr
         env:
@@ -116,7 +116,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - uses: pixtuoid/.github/.github/actions/setup-rust@main
-      - uses: release-plz/action@f67a7e724bdad4a0f6875f186060a0ca2770d76c # v0.5.147
+      - uses: release-plz/action@66b324fd6c72d05d2a08568492ecdd62bfb8a62b # v0.5.148
         with:
           command: release
         env: