diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c28f320..2d4503f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -94,14 +94,14 @@ jobs:
       # `working-directory: ansible`. The key is shared with galaxy-build and with
       # molecule.yml; when they miss together they race to save it and the losers log
       # a harmless "Cache already exists".
-      - uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+      - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: galaxy-cache
         with:
           path: ansible/collections
           key: galaxy-${{ runner.os }}-${{ hashFiles('ansible/requirements.yml') }}
       - name: Install Galaxy collections
         run: make deps          # must precede lint/syntax-check
-      - uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+      - uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         if: steps.galaxy-cache.outputs.cache-hit != 'true'
         with:
           path: ansible/collections
@@ -137,7 +137,7 @@ jobs:
       - name: Install build + import tooling
         run: python -m pip install --upgrade ansible-core ansible-lint galaxy-importer
       # Same cache as ansible-lint (same key, same rationale — see that job).
-      - uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+      - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: galaxy-cache
         with:
           path: ansible/collections
@@ -148,7 +148,7 @@ jobs:
         run: make deps
         env:
           ANSIBLE_COLLECTIONS_PATH: collections
-      - uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+      - uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         if: steps.galaxy-cache.outputs.cache-hit != 'true'
         with:
           path: ansible/collections
@@ -268,7 +268,7 @@ jobs:
       checks: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: reviewdog/action-actionlint@d290e336d5a743810aef4404f757dc862276d2ae # v1.73.4
+      - uses: reviewdog/action-actionlint@8b682e1e7e512151d73a6b9449cbff173846226e # v1.74.0
         with:
           reporter: github-check
           fail_on_error: true
diff --git a/.github/workflows/molecule.yml b/.github/workflows/molecule.yml
index 471cf45..b7cfaf7 100644
--- a/.github/workflows/molecule.yml
+++ b/.github/workflows/molecule.yml
@@ -51,7 +51,7 @@ jobs:
       # copy the way a duplicated env var would. It wraps
       # `make molecule` because the deps install is owned by the Make target here, not
       # by a step of its own.
-      - uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+      - uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: galaxy-cache
         with:
           path: ansible/collections
@@ -75,7 +75,7 @@ jobs:
       # skipped when anything above failed — including a genuinely failing scenario,
       # which leaves the cache cold for that run. Conservative on purpose: it is the
       # same guard that keeps a part-way Galaxy install out of the cache.
-      - uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
+      - uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         if: steps.galaxy-cache.outputs.cache-hit != 'true'
         with:
           path: ansible/collections