diff --git a/.github/workflows/_java.yml b/.github/workflows/_java.yml
index cf7c133..261c051 100644
--- a/.github/workflows/_java.yml
+++ b/.github/workflows/_java.yml
@@ -74,7 +74,7 @@ jobs:
         with:
           version: ${{ inputs.mise_version }}
           cache: true
-      - uses: gradle/actions/setup-gradle@94bac82a5b62952e304b4f7a45a90e19c46c7e50 # v4
+      - uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
       # `mise run audit` shells out to osv-scanner over a generated Gradle lockfile.
       - name: Install osv-scanner
         run: |
@@ -245,7 +245,7 @@ jobs:
       - uses: jdx/mise-action@5228313ee0372e111a38da051671ca30fc5a96db # v3
         with:
           version: ${{ inputs.mise_version }}
-      - uses: gradle/actions/setup-gradle@94bac82a5b62952e304b4f7a45a90e19c46c7e50 # v4
+      - uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
       # Runs the consumer's `spotbugs` mise task (java template default:
       # `./gradlew spotbugsMain`), so a root-Gradle monorepo can point it at
       # `../gradlew :backend:spotbugsMain` without foundry knowing the layout. The