diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 75d2acf..486c4b8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -95,7 +95,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: DeterminateSystems/determinate-nix-action@d96678350ffd6a456235832eb11e1c491589b7bb # v3.21.8
-      - uses: DeterminateSystems/flakehub-cache-action@77c6bddd7d747943530aaa578c57f233ee5d920e # main 2026-07
+      - uses: DeterminateSystems/flakehub-cache-action@e62e272c914d4ad8e4d1587a864e9c3ad2cba9de # main 2026-07
       - run: nix flake check -L
 
   # flake check builds only checks.* ("build skipped" for packages), so the
@@ -110,7 +110,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: DeterminateSystems/determinate-nix-action@d96678350ffd6a456235832eb11e1c491589b7bb # v3.21.8
-      - uses: DeterminateSystems/flakehub-cache-action@77c6bddd7d747943530aaa578c57f233ee5d920e # main 2026-07
+      - uses: DeterminateSystems/flakehub-cache-action@e62e272c914d4ad8e4d1587a864e9c3ad2cba9de # main 2026-07
       - run: nix build .#default -L
 
   # The devenv environment (devenv.nix, the flake devShell's twin) must keep
@@ -131,7 +131,7 @@ jobs:
       - uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
       - run: bun scripts/sync-devenv-lock.ts --check
       - uses: DeterminateSystems/determinate-nix-action@d96678350ffd6a456235832eb11e1c491589b7bb # v3.21.8
-      - uses: DeterminateSystems/flakehub-cache-action@77c6bddd7d747943530aaa578c57f233ee5d920e # main 2026-07
+      - uses: DeterminateSystems/flakehub-cache-action@e62e272c914d4ad8e4d1587a864e9c3ad2cba9de # main 2026-07
       - run: nix run "github:NixOS/nixpkgs/$(jq -r '.nodes[.nodes[.root].inputs.nixpkgs].locked.rev' flake.lock)#devenv" -- test
 
   # Coverage, OUTSIDE the sandbox so the real-nix integration tests
@@ -151,7 +151,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: DeterminateSystems/determinate-nix-action@d96678350ffd6a456235832eb11e1c491589b7bb # v3.21.8
-      - uses: DeterminateSystems/flakehub-cache-action@77c6bddd7d747943530aaa578c57f233ee5d920e # main 2026-07
+      - uses: DeterminateSystems/flakehub-cache-action@e62e272c914d4ad8e4d1587a864e9c3ad2cba9de # main 2026-07
       # rust-cache derives its key partly from the rustc it can see on PATH —
       # which here is the runner's preinstalled toolchain, not the devShell's.
       # The cargo below runs under `nix develop`, so the artifacts are built by
diff --git a/.github/workflows/flakehub-publish.yml b/.github/workflows/flakehub-publish.yml
index 09ad1f1..667d3f8 100644
--- a/.github/workflows/flakehub-publish.yml
+++ b/.github/workflows/flakehub-publish.yml
@@ -36,7 +36,7 @@ jobs:
 
       - uses: DeterminateSystems/determinate-nix-action@d96678350ffd6a456235832eb11e1c491589b7bb # v3.21.8
 
-      - uses: DeterminateSystems/flakehub-cache-action@77c6bddd7d747943530aaa578c57f233ee5d920e # main 2026-07
+      - uses: DeterminateSystems/flakehub-cache-action@e62e272c914d4ad8e4d1587a864e9c3ad2cba9de # main 2026-07
 
       - run: nix build .#default -L
 
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index b32c9fe..6155671 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -35,7 +35,7 @@ jobs:
       # Determinate Nix + FlakeHub cache also make `nix run .#` cheap (the
       # binary and its dep layer come from the cache pushed by CI).
       - uses: DeterminateSystems/determinate-nix-action@d96678350ffd6a456235832eb11e1c491589b7bb # v3.21.8
-      - uses: DeterminateSystems/flakehub-cache-action@77c6bddd7d747943530aaa578c57f233ee5d920e # main 2026-07
+      - uses: DeterminateSystems/flakehub-cache-action@e62e272c914d4ad8e4d1587a864e9c3ad2cba9de # main 2026-07
       - run: bun install --frozen-lockfile
       # This flake has no nixos/darwin configurations, so --all/--sources all
       # cost nothing today; they keep the demo complete if that changes.