diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1c4946f..83cd158 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -120,7 +120,7 @@ jobs:
       # answers the exchange with 400 "No Trusted Publishing config found" —
       # that is expected on the first release, so the step may fail and the
       # publish loop falls back to the registry token below.
-      - uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
+      - uses: rust-lang/crates-io-auth-action@3268eb413133e2960fa4ae0e963ca76380c54cd9 # v1.0.6
         id: auth
         continue-on-error: true
       - name: Publish every crate, in dependency order