diff --git a/.github/workflows/actions.yml b/.github/workflows/actions.yml
index 45ff9e2a..7cd5a0e5 100644
--- a/.github/workflows/actions.yml
+++ b/.github/workflows/actions.yml
@@ -18,4 +18,4 @@ jobs:
       - uses: actions/checkout@v5
         with:
           persist-credentials: false
-      - uses: nicerobot/tools.build/ci/actions@v2
+      - uses: nicerobot/tools.build/ci/actions@v2.6.1
diff --git a/.github/workflows/dockerfiles.yml b/.github/workflows/dockerfiles.yml
index 6a6ac071..19994077 100644
--- a/.github/workflows/dockerfiles.yml
+++ b/.github/workflows/dockerfiles.yml
@@ -18,4 +18,4 @@ jobs:
       - uses: actions/checkout@v5
         with:
           persist-credentials: false
-      - uses: nicerobot/tools.build/ci/dockerfiles@v2
+      - uses: nicerobot/tools.build/ci/dockerfiles@v2.6.1
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 7938183f..60c89eb4 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -18,4 +18,4 @@ jobs:
       - uses: actions/checkout@v5
         with:
           persist-credentials: false
-      - uses: nicerobot/tools.build/ci/docs@v2
+      - uses: nicerobot/tools.build/ci/docs@v2.6.1
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index 399779b5..0dfd9dc7 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -18,4 +18,4 @@ jobs:
       - uses: actions/checkout@v5
         with:
           persist-credentials: false
-      - uses: nicerobot/tools.build/ci/go@v2
+      - uses: nicerobot/tools.build/ci/go@v2.6.1
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 63cf8929..e6f78c3e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,7 +24,7 @@ jobs:
       # Opt out per repo by committing a `.no-autorelease` file to the root: the
       # action detects it and no-ops, so re-distribution can't silently re-enable it.
       - id: tag
-        uses: nicerobot/tools.build/tag@v2
+        uses: nicerobot/tools.build/tag@v2.6.1
 
   # Publishing the tag's artifacts. Without this the tag job mints a version that
   # nothing ever builds: binaries are never attached to the release and, for a
diff --git a/.github/workflows/shell.yml b/.github/workflows/shell.yml
index b5936994..890a05a5 100644
--- a/.github/workflows/shell.yml
+++ b/.github/workflows/shell.yml
@@ -18,4 +18,4 @@ jobs:
       - uses: actions/checkout@v5
         with:
           persist-credentials: false
-      - uses: nicerobot/tools.build/ci/shell@v2
+      - uses: nicerobot/tools.build/ci/shell@v2.6.1