diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index db099c000..7af0bd466 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -85,7 +85,7 @@ jobs:
           shared-key: rust-glibc-release
       - name: Install cargo-nextest
         if: needs.changes.outputs.code == 'true'
-        uses: taiki-e/install-action@ba47c86ac325773530516bb756137ac718732518 # v2.86.5
+        uses: taiki-e/install-action@fcf5432d9f50d67e37ee6e29bdb7a224ff67b4a7 # v2.86.8
         with:
           tool: cargo-nextest
       - name: cargo fmt
@@ -166,7 +166,7 @@ jobs:
       # Prebuilt binary (~2s) instead of `cargo install --locked` (~2-3 min).
       - name: Install cargo-audit
         if: steps.paths.outputs.run == 'true'
-        uses: taiki-e/install-action@ba47c86ac325773530516bb756137ac718732518 # v2.86.5
+        uses: taiki-e/install-action@fcf5432d9f50d67e37ee6e29bdb7a224ff67b4a7 # v2.86.8
         with:
           tool: cargo-audit
       - name: Run cargo audit
@@ -203,7 +203,7 @@ jobs:
 
       - name: Install cargo-deny
         if: steps.paths.outputs.run == 'true'
-        uses: taiki-e/install-action@ba47c86ac325773530516bb756137ac718732518 # v2.86.5
+        uses: taiki-e/install-action@fcf5432d9f50d67e37ee6e29bdb7a224ff67b4a7 # v2.86.8
         with:
           tool: cargo-deny
       - name: Run cargo deny check