diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b2733b4..c4aaf5e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -33,7 +33,7 @@ jobs:
           persist-credentials: false
       - name: Install pinned toolchain from rust-toolchain.toml
         run: rustup show
-      - uses: taiki-e/install-action@183e4297cca2404691e9380e1307288dced5c82a # v2.87.25
+      - uses: taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2.87.28
         with:
           tool: just,cargo-deny
       # The Metal path, executed rather than merely compiled.
@@ -129,7 +129,7 @@ jobs:
       # A prebuilt binary, downloaded every run: never built from source, and
       # never restored from a cache. A gate that reports on whatever a cache
       # held the day it was filled is not reporting on this PR.
-      - uses: taiki-e/install-action@183e4297cca2404691e9380e1307288dced5c82a # v2.87.25
+      - uses: taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2.87.28
         with:
           tool: cargo-semver-checks
       - name: Compare the public API against the published baseline
@@ -153,7 +153,7 @@ jobs:
         with:
           persist-credentials: false
       - run: rustup toolchain install 1.88 --profile minimal
-      - uses: taiki-e/install-action@183e4297cca2404691e9380e1307288dced5c82a # v2.87.25
+      - uses: taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2.87.28
         with:
           tool: just
       - run: just msrv
diff --git a/.github/workflows/prune.yml b/.github/workflows/prune.yml
index 5ccfe52..52b07bd 100644
--- a/.github/workflows/prune.yml
+++ b/.github/workflows/prune.yml
@@ -58,7 +58,7 @@ jobs:
           rustup component add rustc-dev llvm-tools rust-src --toolchain "$PINNED_TOOLCHAIN"
           cargo "+$PINNED_TOOLCHAIN" install --locked cargo-reconverge --version "$RECONVERGE_VERSION"
           cargo "+$PINNED_TOOLCHAIN" install --locked reconverge-driver --version "$RECONVERGE_VERSION"
-      - uses: taiki-e/install-action@183e4297cca2404691e9380e1307288dced5c82a # v2.87.25
+      - uses: taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2.87.28
         with:
           tool: just
       - name: Gate tests (the most important in the repo)
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 517a0f2..5a46680 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -42,7 +42,7 @@ jobs:
           persist-credentials: false
       - name: Install pinned toolchain
         run: rustup show
-      - uses: taiki-e/install-action@183e4297cca2404691e9380e1307288dced5c82a # v2.87.25
+      - uses: taiki-e/install-action@1168f6810a3cb30a3514bf5756a3b7f0422c6df8 # v2.87.28
         with:
           tool: just,cargo-deny
       - run: just ci