diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index ff490e9c..9c4e286e 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -122,7 +122,7 @@ jobs:
           java-version: '17'
       - name: Resolve NDK
         run: echo "ANDROID_NDK_HOME=$ANDROID_NDK_LATEST_HOME" >> "$GITHUB_ENV"
-      - uses: gradle/actions/setup-gradle@v6
+      - uses: gradle/actions/setup-gradle@v6.2.0
         with:
           # v6 extracted the default ("enhanced") Gradle User Home cache into the
           # closed-source `gradle-actions-caching` library (separate Terms of Use).
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 6ddf4cad..e010186d 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -60,7 +60,7 @@ jobs:
       # cargo-audit release needs >= 1.88 to COMPILE. The prebuilt binary RUNS
       # fine under any toolchain — it only parses Cargo.lock, it never compiles
       # the project — so the toolchain pin is irrelevant to it.
-      - uses: taiki-e/install-action@v2
+      - uses: taiki-e/install-action@v2.85.5
         with:
           tool: cargo-audit
       - run: cargo audit
@@ -75,7 +75,7 @@ jobs:
       # Prebuilt binary for the same reason as the audit job: the latest
       # cargo-deny needs rustc >= 1.88 to build from source, while the repo is
       # pinned to 1.96. Policy lives in `deny.toml`.
-      - uses: taiki-e/install-action@v2
+      - uses: taiki-e/install-action@v2.85.5
         with:
           tool: cargo-deny
       - run: cargo deny check
diff --git a/Cargo.lock b/Cargo.lock
index 3c9a0dfb..922924d4 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -706,9 +706,9 @@ dependencies = [
 
 [[package]]
 name = "clap_complete"
-version = "4.6.7"
+version = "4.6.8"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "db8b397918185f0161ff3d6fcaa9e4bfc09b8367caf6e1d4a2848e5477ed027b"
+checksum = "b1f84a88507dbd05c695f2cb5e8558e747179134005e9893882dec964190ed89"
 dependencies = [
  "clap",
 ]
@@ -6238,9 +6238,9 @@ dependencies = [
 
 [[package]]
 name = "wide"
-version = "1.5.0"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "dfdfe6a32973f2d1b268b8895845a8a96cac2f0191e72c27cc929036060dbf89"
+checksum = "be99e8317aa9f08e7d16e13033ca43faab59ab582b1d0feab7b385424c42f8b1"
 dependencies = [
  "bytemuck",
  "safe_arch",