diff --git a/.github/workflows/hybrid-gate.yml b/.github/workflows/hybrid-gate.yml
index 6def0bf..ed9b7e6 100644
--- a/.github/workflows/hybrid-gate.yml
+++ b/.github/workflows/hybrid-gate.yml
@@ -378,7 +378,7 @@ jobs:
       # no Cargo.toml has no toolchain file for this action to detect either,
       # and every consumer of a toolchain (fmt/check/clippy/nextest below)
       # is cargo-shaped, so a non-Rust caller has no use for one.
-      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
+      - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
         if: steps.cargo-manifest.outputs.present == 'true'
         with:
           toolchain: ${{ inputs.rust_toolchain }}
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index bbda390..df03528 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -83,7 +83,7 @@ jobs:
           chmod 0600 ~/.git-credentials
       # WHY: setup-rust-toolchain auto-reads rust-toolchain.toml, so nightly-pinned
       # repos (theatron) get nightly and stable repos get stable with no input.
-      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
+      - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
       - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1
         with:
           command: check advisories licenses bans sources
@@ -115,7 +115,7 @@ jobs:
       # a committed Cargo.lock can still generate one for the scan; MSRV-pinned
       # repos get their pinned rustc, which no longer constrains cargo-audit now
       # that it is installed as a prebuilt binary below.
-      - uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
+      - uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
       # WHY: install cargo-audit as a PREBUILT binary, not `cargo install` from
       # source. A source build couples cargo-audit's climbing MSRV to the target
       # repo's pinned toolchain and fails both ways on MSRV-pinned repos: 0.22.x