diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index f8d3a67..246e7cb 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -11,8 +11,13 @@ jobs:
       # there and the check still runs.
       HAVE_CACHIX: ${{ secrets.CACHIX_AUTH_TOKEN != '' }}
     steps:
-      - uses: actions/checkout@v4
-      - uses: DeterminateSystems/nix-installer-action@v16
+      - uses: actions/checkout@v7
+      - uses: DeterminateSystems/nix-installer-action@v22
+        with:
+          # Upstream Nix, not Determinate Nix: the action has
+          # defaulted determinate to true since v21, and this
+          # project targets the Nix everyone else runs.
+          determinate: false
       - if: env.HAVE_CACHIX == 'true'
         uses: cachix/cachix-action@v17
         with:
@@ -27,8 +32,13 @@ jobs:
     runs-on: ubuntu-latest
     continue-on-error: true
     steps:
-      - uses: actions/checkout@v4
-      - uses: DeterminateSystems/nix-installer-action@v16
+      - uses: actions/checkout@v7
+      - uses: DeterminateSystems/nix-installer-action@v22
+        with:
+          # Upstream Nix, not Determinate Nix: the action has
+          # defaulted determinate to true since v21, and this
+          # project targets the Nix everyone else runs.
+          determinate: false
       - run: |
           nix eval 'github:nix-caisson/caisson-compat#lib.caisson-compat.tests.summary' \
             --override-input caisson "path:$PWD"
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index f640912..cf21f4c 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -17,8 +17,13 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: DeterminateSystems/nix-installer-action@v16
+      - uses: actions/checkout@v7
+      - uses: DeterminateSystems/nix-installer-action@v22
+        with:
+          # Upstream Nix, not Determinate Nix: the action has
+          # defaulted determinate to true since v21, and this
+          # project targets the Nix everyone else runs.
+          determinate: false
       - run: nix run 'nixpkgs#mdbook' -- build
       - uses: actions/configure-pages@v5
       - uses: actions/upload-pages-artifact@v3
diff --git a/pins.nix b/pins.nix
index 05a6f36..f84191f 100644
--- a/pins.nix
+++ b/pins.nix
@@ -16,8 +16,8 @@
   caisson-core = {
     owner = "nix-caisson";
     repo = "caisson-core";
-    rev = "f0670d3a2419bfa603fc7041ce77d8915ecbb915";
-    narHash = "sha256-smVchmdqGUAwe6lw4hUjWTdmvPKa1ePPEkk6piyFWps=";
+    rev = "32a7fae933827fd953959535af2ddc170366cafb";
+    narHash = "sha256-ari+MqiCE5DrdxI+1yUSCyZQRf2Or82O9gCJcRTuxgY=";
   };
   # The base library: the nixpkgs.lib mirror (nixpkgs' lib directory
   # published on its own, a small fetch; the lib sits under /lib).