diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index f3c48764a..32b49b1bf 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -62,7 +62,7 @@ jobs:
           path: bencher.dev.sn.json
 
       # Upload to graphing service
-      - uses: bencherdev/bencher@main
+      - uses: bencherdev/bencher@4c83b25441d145ee273adaf74be30f2382e6ba85
       - name: Upload benchmark results to Bencher
         run: |
           bencher run \
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 5b968030c..3a28b3e56 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -152,7 +152,7 @@ jobs:
     name: Bazel - ${{ matrix.os }} ${{ matrix.build-type }}
     steps:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-    - uses: bazelbuild/setup-bazelisk@b39c379c82683a5f25d34f0d062761f62693e0b2 # v3.0.0
+    - uses: bazel-contrib/setup-bazel@c5acdfb288317d0b5c0bbd7a396a3dc868bb0f86 # v0.19.0
     - name: Mount bazel cache  # Optional
       uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 34e5bdcaa..ca2d2a0d3 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -54,11 +54,10 @@ jobs:
       # Don't abort runners if a single one fails
       fail-fast: false
     steps:
-    - uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1.0.7
-      with:
-        toolchain: ${{ matrix.rust }}
     - name: Checkout
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - name: Select Rust toolchain
+      run: rustup override set ${{ matrix.rust }}
     - name: update dependency
       run: |
         if bash -c 'uname -s | grep 'Linux' >/dev/null'; then
@@ -77,11 +76,10 @@ jobs:
       run:
         shell: bash
     steps:
-    - uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1.0.7
-      with:
-        toolchain: stable
     - name: Checkout
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - name: Select Rust toolchain
+      run: rustup override set stable
     - name: update dependency
       run: sudo apt-get update -y && sudo apt-get --reinstall install -y libc6-dev
     - name: Dry-run workspace publish