diff --git a/.github/workflows/external-links.yml b/.github/workflows/external-links.yml
index 855f82b..4bd60ac 100644
--- a/.github/workflows/external-links.yml
+++ b/.github/workflows/external-links.yml
@@ -22,7 +22,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Setup Ruby
-        uses: ruby/setup-ruby@e81a8fa391b11a595c1b7ed84177cc0fe02faf83 # v1.328.0
+        uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # v1.335.0
         with:
           bundler-cache: true
       - name: Build with Jekyll
diff --git a/.github/workflows/jekyll.yml b/.github/workflows/jekyll.yml
index c450e4e..66b0ac2 100644
--- a/.github/workflows/jekyll.yml
+++ b/.github/workflows/jekyll.yml
@@ -48,7 +48,7 @@ jobs:
       # together. If this assumption is ever wrong the build job fails and
       # `deploy` (needs: build) publishes nothing.
       - name: Setup Ruby
-        uses: ruby/setup-ruby@e81a8fa391b11a595c1b7ed84177cc0fe02faf83 # v1.328.0
+        uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # v1.335.0
         # The version comes from .ruby-version (3.3+: html-proofer's
         # async→console dependency requires Ruby >= 3.3).
         with: