diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f7564f83..b23cdf82 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -173,7 +173,7 @@ jobs:
           # triggering ref.
           ref: ${{ github.event.inputs.pr != '' && format('refs/pull/{0}/merge', github.event.inputs.pr) || '' }}
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31
         with:
           # The forks' functional CI is `nix build` of their own flakes, and the
           # whole toolchain — language runtimes AND the nixpkgs tools — is built
@@ -287,7 +287,7 @@ jobs:
           ref: ${{ github.event.inputs.pr != '' && format('refs/pull/{0}/merge', github.event.inputs.pr) || '' }}
 
       - if: matrix.run == 'true'
-        uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31
+        uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31
         with:
           # The forks' functional CI is `nix build` of their own flakes, and the
           # whole toolchain — language runtimes AND the nixpkgs tools — is built
@@ -457,7 +457,7 @@ jobs:
           # on every other event (see setup's checkout).
           ref: ${{ github.event.inputs.pr != '' && format('refs/pull/{0}/merge', github.event.inputs.pr) || '' }}
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31
         with:
           # The forks' functional CI is `nix build` of their own flakes, and the
           # whole toolchain — language runtimes AND the nixpkgs tools — is built
@@ -609,7 +609,7 @@ jobs:
           # on every other event (see setup's checkout).
           ref: ${{ github.event.inputs.pr != '' && format('refs/pull/{0}/merge', github.event.inputs.pr) || '' }}
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31
         with:
           # The forks' functional CI is `nix build` of their own flakes, and the
           # whole toolchain — language runtimes AND the nixpkgs tools — is built
@@ -836,7 +836,7 @@ jobs:
           # on every other event (see setup's checkout).
           ref: ${{ github.event.inputs.pr != '' && format('refs/pull/{0}/merge', github.event.inputs.pr) || '' }}
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31
         with:
           # The forks' functional CI is `nix build` of their own flakes, and the
           # whole toolchain — language runtimes AND the nixpkgs tools — is built
@@ -1098,7 +1098,7 @@ jobs:
           # on every other event (see setup's checkout).
           ref: ${{ github.event.inputs.pr != '' && format('refs/pull/{0}/merge', github.event.inputs.pr) || '' }}
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31
         with:
           # The forks' functional CI is `nix build` of their own flakes, and the
           # whole toolchain — language runtimes AND the nixpkgs tools — is built
@@ -2048,7 +2048,7 @@ jobs:
           # cleanly, matching the moon job's checkout.
           fetch-depth: 0
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31
         with:
           # The SAME two-cache trust posture as the moon job — the two
           # substituters the vendored forks use plus their trusted keys, never
diff --git a/.github/workflows/eng-docs-deploy.yml b/.github/workflows/eng-docs-deploy.yml
index 6f587606..e400c766 100644
--- a/.github/workflows/eng-docs-deploy.yml
+++ b/.github/workflows/eng-docs-deploy.yml
@@ -39,7 +39,7 @@ jobs:
           # ci.yml's checkout (ci.yml:130-135).
           fetch-depth: 0
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31
         with:
           # The docsite build runs under moon, whose toolchain (bun/node/moon)
           # comes from nix, not `setup-*` actions — the same posture ci.yml
diff --git a/.github/workflows/publish-agent-image.yml b/.github/workflows/publish-agent-image.yml
index 794a4a05..e80c2ec5 100644
--- a/.github/workflows/publish-agent-image.yml
+++ b/.github/workflows/publish-agent-image.yml
@@ -100,7 +100,7 @@ jobs:
       # for the :git-<sha> tag).
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31
         with:
           # nix-command + flakes for the RigelBuild forks' flakes. The two caches
           # are declared HERE, not delegated via `accept-flake-config` — that
diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
index dde8d2c0..20a2f7e1 100644
--- a/.github/workflows/renovate.yml
+++ b/.github/workflows/renovate.yml
@@ -50,7 +50,7 @@ jobs:
           # shallow single-ref checkout.
           fetch-depth: 0
 
-      - uses: cachix/install-nix-action@630ae543ea3a38a9a4166f03376c02c50f408342 # v31
+      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31
         with:
           # Same trust posture as ci.yml — name the two caches the devenv build
           # legitimately uses in this reviewed file rather than delegating via