diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 763817264d..c7e29d3c5e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -850,7 +850,7 @@ jobs:
           submodules: false
 
       - name: Setup Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.2.0
         with:
           distribution: temurin
           # Keep sdkmanager on the stable JDK path for Linux CI runners.
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index e3f9db202b..67c97e5f24 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -89,7 +89,7 @@ jobs:
 
       - name: Setup Java
         if: matrix.needs_java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.2.0
         with:
           distribution: temurin
           java-version: "21"