diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4081358c..9cd18922 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -196,7 +196,7 @@ jobs:
           node-version: 22.22.3
       - name: Setup Rust
         if: matrix.suite == 'lynx-stack'
-        uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
       - name: Expose GitHub Runtime
         uses: crazy-max/ghaction-github-runtime@04d248b84655b509d8c44dc1d6f990c879747487 # v4
       # Verdaccio is required for rspack-stack testing.
diff --git a/.github/workflows/rspack-ecosystem-ci-from-commit.yml b/.github/workflows/rspack-ecosystem-ci-from-commit.yml
index 82364240..f8e1d0fc 100644
--- a/.github/workflows/rspack-ecosystem-ci-from-commit.yml
+++ b/.github/workflows/rspack-ecosystem-ci-from-commit.yml
@@ -119,7 +119,7 @@ jobs:
           ref: ${{ inputs.commitSHA }}
       - name: Setup Rust
         if: inputs.suite == 'lynx-stack'
-        uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
       - run: pnpm i --frozen-lockfile
       - name: Expose GitHub Runtime
         uses: crazy-max/ghaction-github-runtime@04d248b84655b509d8c44dc1d6f990c879747487 # v4
diff --git a/.github/workflows/rspack-ecosystem-ci-from-pr.yml b/.github/workflows/rspack-ecosystem-ci-from-pr.yml
index fb0027b3..2cb55275 100644
--- a/.github/workflows/rspack-ecosystem-ci-from-pr.yml
+++ b/.github/workflows/rspack-ecosystem-ci-from-pr.yml
@@ -100,7 +100,7 @@ jobs:
           ref: ${{ inputs.branchName }}
       - name: Setup Rust
         if: inputs.suite == 'lynx-stack'
-        uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
       - run: pnpm i --frozen-lockfile
       - name: Expose GitHub Runtime
         uses: crazy-max/ghaction-github-runtime@04d248b84655b509d8c44dc1d6f990c879747487 # v4