diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index b3d0bab..e45a957 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -49,7 +49,7 @@ jobs:
         with:
           distribution: temurin
           java-version: 25
-      - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
+      - uses: gradle/actions/setup-gradle@8da46b539cd8fe6ab27ca75128919a18d757604c # v6.4.1
       # Run here as well as in ci.yml, so a bundle that reaches Play is one whose own
       # commit passed, not one that merely shares a branch with a commit that did.
       - run: ./gradlew test
@@ -103,7 +103,7 @@ jobs:
         with:
           distribution: temurin
           java-version: 25
-      - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
+      - uses: gradle/actions/setup-gradle@8da46b539cd8fe6ab27ca75128919a18d757604c # v6.4.1
         if: steps.publishable.outputs.ready == 'true'
 
       - name: Build the signed bundle
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1fc218b..073eeb5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -91,7 +91,7 @@ jobs:
         with:
           distribution: temurin
           java-version: 25
-      - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
+      - uses: gradle/actions/setup-gradle@8da46b539cd8fe6ab27ca75128919a18d757604c # v6.4.1
       - run: ./gradlew test
 
   # The end-to-end encryption reference (docs/e2ee.md): the round trips, and that