diff --git a/.github/workflows/actions.yml b/.github/workflows/actions.yml
index cbecece..6d1ad04 100644
--- a/.github/workflows/actions.yml
+++ b/.github/workflows/actions.yml
@@ -24,4 +24,4 @@ jobs:
       - uses: actions/checkout@v5
         with:
           persist-credentials: false
-      - uses: nicerobot/tools.build/ci/actions@v2
+      - uses: nicerobot/tools.build/ci/actions@v2.6.1
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index e56393b..b9c867a 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -24,4 +24,4 @@ jobs:
       - uses: actions/checkout@v5
         with:
           persist-credentials: false
-      - uses: nicerobot/tools.build/ci/docs@v2
+      - uses: nicerobot/tools.build/ci/docs@v2.6.1
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4ade1a6..bd60481 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,7 +24,7 @@ jobs:
       # Opt out per repo by committing a `.no-autorelease` file to the root: the
       # action detects it and no-ops, so re-distribution can't silently re-enable it.
       - id: tag
-        uses: nicerobot/tools.build/tag@v2
+        uses: nicerobot/tools.build/tag@v2.6.1
 
   # Publishing the tag's artifacts. Without this the tag job mints a version that
   # nothing ever builds: binaries are never attached to the release and, for a