diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 33c5a7d..d0d68e6 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -15,7 +15,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Install mise toolchain
-        uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 # v5.1.2
+        uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0
         with:
           cache: false
       - name: Run release gate
@@ -39,7 +39,7 @@ jobs:
         with:
           persist-credentials: false # no step pushes back to the repository
       - name: Install mise toolchain
-        uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 # v5.1.2
+        uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0
         with:
           cache: false # a poisoned tool cache must never reach published artifacts
       - name: Build API documentation
@@ -66,7 +66,7 @@ jobs:
         with:
           persist-credentials: false # the registry login below carries its own token
       - name: Install mise toolchain
-        uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 # v5.1.2
+        uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0
         with:
           cache: false
       - name: Set lower-case image path
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a0d5414..8e5375c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,7 +19,7 @@ jobs:
         with:
           persist-credentials: false # no step pushes back to the repository
       - name: Install mise toolchain
-        uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 # v5.1.2
+        uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0
         with:
           cache: true
       - name: Run canonical gate
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index e0c8226..648bba6 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -24,7 +24,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false # scanners only read the checkout
       - name: Install mise toolchain
-        uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 # v5.1.2
+        uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0
       - name: Scan complete Git history
         run: gitleaks git --redact=100 --verbose
       - name: Scan full checkout