diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c9cf17e..27456b0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,7 +32,7 @@ jobs:
           ref: a26c18c90c7d6102bbe26eb50cbb90fcd1bd46e3
           path: qqq-print-protocol
           persist-credentials: false
-      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: temurin
           java-version: '21'
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 8da4dcc..6859800 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -65,7 +65,7 @@ jobs:
       # Resolve the actual deployed profile, including frontend assets.
       # Do not restore an Actions cache in this security job.
       - name: Set up Java
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: temurin
           java-version: '21'