diff --git a/.github/actions/setup-ocaml/action.yml b/.github/actions/setup-ocaml/action.yml
index 24dcb87563..7d8fc79995 100644
--- a/.github/actions/setup-ocaml/action.yml
+++ b/.github/actions/setup-ocaml/action.yml
@@ -30,20 +30,20 @@ runs:
       if: runner.os != 'Windows'
       shell: bash
       env:
-        BINARYEN_VERSION: "131"
+        BINARYEN_VERSION: "133"
       run: |
         case "$RUNNER_OS-$RUNNER_ARCH" in
           Linux-X64)
             platform=x86_64-linux
-            checksum=b5bf1f0eaf17c63ee588ff7a5954dc8f6ce2c26989051c66f24dfe9ece3e46db
+            checksum=2dc9c7813f5375db93d96ead4b78222fcc3e2677bbb832297af4797782a37489
             ;;
           Linux-ARM64)
             platform=aarch64-linux
-            checksum=ba991f677edd9a21d2bc96c0144bc8ac5b112d4d98a3eb266e075e22e557df2a
+            checksum=89c07ea56faf38d0fbecf36ca8ec0721756716185f265b568e133d427f299bf8
             ;;
           macOS-ARM64)
             platform=arm64-macos
-            checksum=e441b48dc22163d209b4f05e44dc7210909b01237642b6c9ae48fd710a3ef83e
+            checksum=ad66da82ac13f163e424b1643f16c6dfcccc98b5966296b43e52d3cab04f84a8
             ;;
           *)
             echo "Unsupported Binaryen platform: $RUNNER_OS-$RUNNER_ARCH" >&2
@@ -75,6 +75,8 @@ runs:
         COMPILER: ${{ inputs.compiler }}
         DEPENDENCY_FLAGS: ${{ inputs.dependency-flags }}
         OS: ${{ inputs.os }}
+      # 3.9.0 is the ocaml/setup-ocaml version below. Update both together:
+      # Dependabot bumps only the `uses:` line, and a cache hit skips that step.
       run: |
         dependency_flags_key="${DEPENDENCY_FLAGS//--/}"
         dependency_flags_key="${dependency_flags_key// /_}"
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index c2daf05fa7..fbada6c333 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -6,8 +6,11 @@ updates:
     schedule:
       interval: "weekly"
 
-  # Manage GitHub Actions dependencies
+  # Manage GitHub Actions dependencies in the workflows and in the composite
+  # actions under .github/actions
   - package-ecosystem: "github-actions"
-    directory: "/"
+    directories:
+      - "/"
+      - "/.github/actions/*"
     schedule:
       interval: "weekly"
diff --git a/.github/workflows/playground_preview_cleanup.yml b/.github/workflows/playground_preview_cleanup.yml
index 5d81c9e8c3..7aa2fdfcd5 100644
--- a/.github/workflows/playground_preview_cleanup.yml
+++ b/.github/workflows/playground_preview_cleanup.yml
@@ -11,10 +11,10 @@ jobs:
     runs-on: ubuntu-26.04
     steps:
       - name: Setup Rclone
-        uses: cometkim/rclone-actions/setup-rclone@main
+        uses: cometkim/rclone-actions/setup-rclone@8d9c6b95341f7698609deee65c3d62af42893288 # main, 2025-06-18
 
       - name: Configure Rclone remote
-        uses: cometkim/rclone-actions/configure-remote/s3-provider@main
+        uses: cometkim/rclone-actions/configure-remote/s3-provider@8d9c6b95341f7698609deee65c3d62af42893288 # main, 2025-06-18
         with:
           name: rescript
           provider: Cloudflare
diff --git a/.github/workflows/playground_preview_upload.yml b/.github/workflows/playground_preview_upload.yml
index ecf5ea05e6..0165f1e655 100644
--- a/.github/workflows/playground_preview_upload.yml
+++ b/.github/workflows/playground_preview_upload.yml
@@ -25,10 +25,10 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Setup Rclone
-        uses: cometkim/rclone-actions/setup-rclone@main
+        uses: cometkim/rclone-actions/setup-rclone@8d9c6b95341f7698609deee65c3d62af42893288 # main, 2025-06-18
 
       - name: Configure Rclone remote
-        uses: cometkim/rclone-actions/configure-remote/s3-provider@main
+        uses: cometkim/rclone-actions/configure-remote/s3-provider@8d9c6b95341f7698609deee65c3d62af42893288 # main, 2025-06-18
         with:
           name: rescript
           provider: Cloudflare
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 78eeb65c3d..e42924a2a7 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -137,10 +137,10 @@ jobs:
           path: packages/playground
 
       - name: Setup Rclone
-        uses: cometkim/rclone-actions/setup-rclone@main
+        uses: cometkim/rclone-actions/setup-rclone@8d9c6b95341f7698609deee65c3d62af42893288 # main, 2025-06-18
 
       - name: Configure Rclone remote
-        uses: cometkim/rclone-actions/configure-remote/s3-provider@main
+        uses: cometkim/rclone-actions/configure-remote/s3-provider@8d9c6b95341f7698609deee65c3d62af42893288 # main, 2025-06-18
         with:
           name: rescript
           provider: Cloudflare
diff --git a/.github/workflows/semantic_diff.yml b/.github/workflows/semantic_diff.yml
index ed228d31d0..8bb1c65a48 100644
--- a/.github/workflows/semantic_diff.yml
+++ b/.github/workflows/semantic_diff.yml
@@ -53,10 +53,10 @@ jobs:
           echo "head=$(git rev-parse --short=9 "pr-${PR_NUMBER}")" >> "$GITHUB_OUTPUT"
 
       - name: Setup Rclone
-        uses: cometkim/rclone-actions/setup-rclone@main
+        uses: cometkim/rclone-actions/setup-rclone@8d9c6b95341f7698609deee65c3d62af42893288 # main, 2025-06-18
 
       - name: Configure Rclone remote
-        uses: cometkim/rclone-actions/configure-remote/s3-provider@main
+        uses: cometkim/rclone-actions/configure-remote/s3-provider@8d9c6b95341f7698609deee65c3d62af42893288 # main, 2025-06-18
         with:
           name: rescript
           provider: Cloudflare
@@ -91,10 +91,10 @@ jobs:
     permissions: {}
     steps:
       - name: Setup Rclone
-        uses: cometkim/rclone-actions/setup-rclone@main
+        uses: cometkim/rclone-actions/setup-rclone@8d9c6b95341f7698609deee65c3d62af42893288 # main, 2025-06-18
 
       - name: Configure Rclone remote
-        uses: cometkim/rclone-actions/configure-remote/s3-provider@main
+        uses: cometkim/rclone-actions/configure-remote/s3-provider@8d9c6b95341f7698609deee65c3d62af42893288 # main, 2025-06-18
         with:
           name: rescript
           provider: Cloudflare
diff --git a/changes/ci-dependency-pins.internal.md b/changes/ci-dependency-pins.internal.md
new file mode 100644
index 0000000000..efd40fd45c
--- /dev/null
+++ b/changes/ci-dependency-pins.internal.md
@@ -0,0 +1 @@
+- Update Binaryen to 133 in CI, pin cometkim/rclone-actions to a commit, and let Dependabot update the actions used by composite actions.