diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d8531c91..3250803e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -244,7 +244,7 @@ jobs:
       # cargo-nextest runs the manifest's test binaries in parallel (C6).
       - name: Install cargo-nextest
         if: matrix.label != 'msrv'
-        uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31
+        uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68 # v2.88.1
         with:
           tool: cargo-nextest@0.9.146
       - name: Real-file, CLI and contract verification
@@ -332,7 +332,7 @@ jobs:
           save-if: ${{ github.ref == 'refs/heads/main' }}
           shared-key: ci-i686
       - name: Install cargo-nextest
-        uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31
+        uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68 # v2.88.1
         with:
           tool: cargo-nextest@0.9.146
       - name: Real-file, CLI, contract and hardening checks on i686
@@ -433,7 +433,7 @@ jobs:
       # corpus-reading target is gated the moment it exists.
       # cargo-nextest runs the manifest's test binaries in parallel (C6).
       - name: Install cargo-nextest
-        uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31
+        uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68 # v2.88.1
         with:
           tool: cargo-nextest@0.9.146
       - name: Tier-two gates (real-file, CLI and contract targets against the project corpus)
@@ -834,7 +834,7 @@ jobs:
           echo CARGO_TERM_COLOR=always >> "$GITHUB_ENV"
           rustc --version
       - name: Install cargo-semver-checks and cargo-public-api
-        uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31
+        uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68 # v2.88.1
         with:
           tool: cargo-semver-checks@0.51.0,cargo-public-api@0.52.0
       - name: The stable API breaks nothing the pull request does not announce
@@ -1093,7 +1093,7 @@ jobs:
       # `curl --silent -L` and failed the check when GitHub returned an
       # error page ("gzip: invalid magic").
       - name: Install cargo-deny
-        uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31
+        uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68 # v2.88.1
         with:
           tool: cargo-deny@0.20.2
       - run: cargo deny check
@@ -1118,7 +1118,7 @@ jobs:
           echo CARGO_TERM_COLOR=always >> "$GITHUB_ENV"
           rustc --version
       - name: Install cargo-audit
-        uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31
+        uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68 # v2.88.1
         with:
           tool: cargo-audit@0.22.2
       - name: Audit Rust dependencies
diff --git a/.github/workflows/deploy-viewer.yml b/.github/workflows/deploy-viewer.yml
index e247ed16..c73ebfcf 100644
--- a/.github/workflows/deploy-viewer.yml
+++ b/.github/workflows/deploy-viewer.yml
@@ -102,7 +102,7 @@ jobs:
           shared-key: viewer-wasm
 
       - name: Install wasm-pack
-        uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91  # v2.87.31
+        uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68  # v2.88.1
         with:
           tool: wasm-pack@0.14.0
 
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index 4003bb7c..2f688895 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -107,7 +107,7 @@ jobs:
       # A prebuilt, checksummed binary: compiling cargo-fuzz from source took
       # a large part of each job's setup (C4).
       - name: Install cargo-fuzz
-        uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31
+        uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68 # v2.88.1
         with:
           tool: cargo-fuzz@0.13.2
 
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index b7ee6636..8d646084 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -316,7 +316,7 @@ jobs:
           echo CARGO_TERM_COLOR=always >> "$GITHUB_ENV"
           rustc --version
       - name: Install wasm-pack
-        uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31
+        uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68 # v2.88.1
         with:
           tool: wasm-pack@0.14.0
       - uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
diff --git a/.github/workflows/release-binaries.yml b/.github/workflows/release-binaries.yml
index ac91f7a5..3ea5de8f 100644
--- a/.github/workflows/release-binaries.yml
+++ b/.github/workflows/release-binaries.yml
@@ -101,7 +101,7 @@ jobs:
       # `cargo audit bin` and other scanners can check a shipped binary
       # against advisories (C10).
       - name: Install cargo-auditable
-        uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31
+        uses: taiki-e/install-action@68a389c788b2cd04016ce8c80ee23b80d2ab3d68 # v2.88.1
         with:
           tool: cargo-auditable@0.7.7
       - name: Build release binaries