diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0755267..db795b0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -65,14 +65,14 @@ jobs:
           mix local.rebar --force
 
       - name: Cache npm
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
         with:
           path: ~/.npm
           key: ${{ runner.os }}-npm-${{ hashFiles('assets/package-lock.json') }}
           restore-keys: ${{ runner.os }}-npm-
 
       - name: Cache deps and _build
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
         with:
           path: |
             deps
@@ -81,7 +81,7 @@ jobs:
           restore-keys: ${{ runner.os }}-mix-
 
       - name: Cache dialyzer PLTs
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
         with:
           path: priv/plts
           key: ${{ runner.os }}-plt-${{ hashFiles('mix.lock') }}
@@ -158,7 +158,7 @@ jobs:
           mix local.rebar --force
 
       - name: Cache npm
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
         with:
           path: ~/.npm
           key: ${{ runner.os }}-npm-${{ hashFiles('assets/package-lock.json') }}
@@ -167,7 +167,7 @@ jobs:
       # Keyed on MIX_ENV so the dev build artefacts don't clobber the build
       # job's test PLT/_build cache (different env, different compiled output).
       - name: Cache deps and _build
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
         with:
           path: |
             deps
@@ -183,7 +183,7 @@ jobs:
         working-directory: assets
 
       - name: Cache Playwright browsers
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
         with:
           path: ~/.cache/ms-playwright
           key: ${{ runner.os }}-playwright-${{ hashFiles('assets/package-lock.json') }}