diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 75d2acf..1f3481a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -162,7 +162,7 @@ jobs:
       # rebuilding all ~100 dependencies anyway. Keying on flake.lock ties the
       # cache to the compiler that actually produced it: a bump misses cleanly
       # and repopulates instead of silently poisoning the entry.
-      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           key: ${{ hashFiles('flake.lock') }}
       # --workspace is load-bearing, not decoration. cargo-llvm-cov scopes its
diff --git a/.github/workflows/npm-release.yml b/.github/workflows/npm-release.yml
index cd618e3..a2b77c4 100644
--- a/.github/workflows/npm-release.yml
+++ b/.github/workflows/npm-release.yml
@@ -35,7 +35,7 @@ jobs:
             npm-target: linux-arm64
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           key: ${{ matrix.rust-target }}
       - run: rustup target add ${{ matrix.rust-target }}
@@ -57,7 +57,7 @@ jobs:
     runs-on: ${{ matrix.runner }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
         with:
           key: ${{ matrix.rust-target }}
       - run: rustup target add ${{ matrix.rust-target }}