diff --git a/.github/workflows/actions.yml b/.github/workflows/actions.yml
index 32c8ab8..e86de24 100644
--- a/.github/workflows/actions.yml
+++ b/.github/workflows/actions.yml
@@ -24,4 +24,4 @@ jobs:
       - uses: actions/checkout@v5
         with:
           persist-credentials: false
-      - uses: nicerobot/tools.build/ci/actions@v2
+      - uses: nicerobot/tools.build/ci/actions@v2.6.1
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 20c0bc1..f1894cf 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -24,4 +24,4 @@ jobs:
       - uses: actions/checkout@v5
         with:
           persist-credentials: false
-      - uses: nicerobot/tools.build/ci/docs@v2
+      - uses: nicerobot/tools.build/ci/docs@v2.6.1
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index f48e48a..d143acc 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -26,7 +26,7 @@ jobs:
       - uses: actions/checkout@v5
         with:
           persist-credentials: false
-      - uses: nicerobot/tools.build/ci/go@v2
+      - uses: nicerobot/tools.build/ci/go@v2.6.1
 
   # Early warning, NOT a gate. The `go` job above is the gate, and it pins the
   # toolchain via the ci/go@v2 image so every repo compiles identically. This job
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 63cf892..e6f78c3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,7 +24,7 @@ jobs:
       # Opt out per repo by committing a `.no-autorelease` file to the root: the
       # action detects it and no-ops, so re-distribution can't silently re-enable it.
       - id: tag
-        uses: nicerobot/tools.build/tag@v2
+        uses: nicerobot/tools.build/tag@v2.6.1
 
   # Publishing the tag's artifacts. Without this the tag job mints a version that
   # nothing ever builds: binaries are never attached to the release and, for a