diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index ec0056a..3d0a73c 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -29,7 +29,7 @@ jobs:
       - uses: Swatinem/rust-cache@v2
       - name: Install protobuf compiler
         run: bash scripts/ci/install-protobuf.sh
-      - uses: taiki-e/install-action@v2
+      - uses: taiki-e/install-action@v2.85.6
         with:
           tool: cargo-llvm-cov
       - name: Generate coverage
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 3cf6a50..67870dd 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -25,7 +25,7 @@ jobs:
       - uses: dtolnay/rust-toolchain@stable
         with:
           toolchain: "1.96.0"
-      - uses: taiki-e/install-action@v2
+      - uses: taiki-e/install-action@v2.85.6
         with:
           tool: cargo-audit
       - name: Run cargo-audit (blocking)
@@ -38,7 +38,7 @@ jobs:
       - uses: actions/checkout@v6
       - name: Checkout Reflective sibling dependencies
         run: bash scripts/ci/checkout-reflective-siblings.sh
-      - uses: taiki-e/install-action@v2
+      - uses: taiki-e/install-action@v2.85.6
         with:
           tool: cargo-deny
       - name: Run cargo-deny
diff --git a/.github/workflows/stability.yml b/.github/workflows/stability.yml
index a181394..94f60d9 100644
--- a/.github/workflows/stability.yml
+++ b/.github/workflows/stability.yml
@@ -93,7 +93,7 @@ jobs:
       - uses: dtolnay/rust-toolchain@stable
         with:
           toolchain: ${{ env.RUST_VERSION }}
-      - uses: taiki-e/install-action@v2
+      - uses: taiki-e/install-action@v2.85.6
         with:
           tool: cargo-audit
       - name: Run cargo-audit (blocking)
@@ -114,7 +114,7 @@ jobs:
         with:
           toolchain: ${{ env.RUST_VERSION }}
       - uses: Swatinem/rust-cache@v2
-      - uses: taiki-e/install-action@v2
+      - uses: taiki-e/install-action@v2.85.6
         with:
           tool: cargo-deny
       - name: Run cargo-deny