diff --git a/.github/workflows/gate.yml b/.github/workflows/gate.yml
index af2711f..ae96fc8 100644
--- a/.github/workflows/gate.yml
+++ b/.github/workflows/gate.yml
@@ -64,7 +64,7 @@ jobs:
       # for: a runner image's OTP patch bump carries a dialyzer bump, and a PLT from another
       # dialyzer is refused -- with a cache that never overwrites a key, the major alone made
       # a permanent red) and the lock: built cold once per key (87-116 s measured), restored after.
-      - uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+      - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: _build/dialyzer
           key: dialyzer-${{ steps.beam.outputs.otp-version }}-${{ steps.beam.outputs.elixir-version }}-${{ hashFiles('mix.lock') }}