diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml
index 4b38d34..9cd7525 100644
--- a/.github/workflows/bench.yml
+++ b/.github/workflows/bench.yml
@@ -22,6 +22,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: actions-rust-lang/setup-rust-toolchain@c8ff772090ab9d00f7f7bd7b388f3c3032282e3b  # v2.0.0
+      - uses: actions-rust-lang/setup-rust-toolchain@b328d6be848e9b620901df2e49d27ad7e5536c0b  # v2.0.0
       - name: cargo bench (no-op if no benches)
         run: cargo bench --workspace --no-run
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0dd2e8b..5a5c01a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,7 +27,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
-      - uses: actions-rust-lang/setup-rust-toolchain@c8ff772090ab9d00f7f7bd7b388f3c3032282e3b  # v2.0.0
+      - uses: actions-rust-lang/setup-rust-toolchain@b328d6be848e9b620901df2e49d27ad7e5536c0b  # v2.0.0
         with:
           toolchain: stable
           components: rustfmt, clippy
@@ -118,7 +118,7 @@ jobs:
     needs: gates
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: actions-rust-lang/setup-rust-toolchain@c8ff772090ab9d00f7f7bd7b388f3c3032282e3b  # v2.0.0
+      - uses: actions-rust-lang/setup-rust-toolchain@b328d6be848e9b620901df2e49d27ad7e5536c0b  # v2.0.0
       - name: build + check size
         run: |
           cargo build --release -p ocserve
@@ -144,7 +144,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: actions-rust-lang/setup-rust-toolchain@c8ff772090ab9d00f7f7bd7b388f3c3032282e3b  # v2.0.0
+      - uses: actions-rust-lang/setup-rust-toolchain@b328d6be848e9b620901df2e49d27ad7e5536c0b  # v2.0.0
       - name: install arm64 cross toolchain + target
         run: |
           rustup target add aarch64-unknown-linux-gnu
@@ -175,7 +175,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: actions-rust-lang/setup-rust-toolchain@c8ff772090ab9d00f7f7bd7b388f3c3032282e3b  # v2.0.0
+      - uses: actions-rust-lang/setup-rust-toolchain@b328d6be848e9b620901df2e49d27ad7e5536c0b  # v2.0.0
         with:
           # setup-rust-toolchain v2 defaults to CARGO_BUILD_WARNINGS=deny. The
           # musl link of BoringSSL emits a linker path warning from its build
@@ -237,7 +237,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: actions-rust-lang/setup-rust-toolchain@c8ff772090ab9d00f7f7bd7b388f3c3032282e3b  # v2.0.0
+      - uses: actions-rust-lang/setup-rust-toolchain@b328d6be848e9b620901df2e49d27ad7e5536c0b  # v2.0.0
       - name: cargo check
         # `check`, not `build`: link-time gaps in the OS layer are Phase P/W work,
         # and a type error is what the two ungated unix imports used to produce.
@@ -348,7 +348,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: actions-rust-lang/setup-rust-toolchain@c8ff772090ab9d00f7f7bd7b388f3c3032282e3b  # v2.0.0
+      - uses: actions-rust-lang/setup-rust-toolchain@b328d6be848e9b620901df2e49d27ad7e5536c0b  # v2.0.0
       - name: install cargo-deny
         run: cargo install cargo-deny --locked
       - name: cargo-deny
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 66f53d0..de2eab7 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -25,7 +25,7 @@ jobs:
         language: ['rust']
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: actions-rust-lang/setup-rust-toolchain@c8ff772090ab9d00f7f7bd7b388f3c3032282e3b  # v2.0.0
+      - uses: actions-rust-lang/setup-rust-toolchain@b328d6be848e9b620901df2e49d27ad7e5536c0b  # v2.0.0
       - name: initialize CodeQL
         uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370  # v4.39.1
         with:
diff --git a/.github/workflows/hardening.yml b/.github/workflows/hardening.yml
index 2a22b90..36b1b51 100644
--- a/.github/workflows/hardening.yml
+++ b/.github/workflows/hardening.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: actions-rust-lang/setup-rust-toolchain@c8ff772090ab9d00f7f7bd7b388f3c3032282e3b  # v2.0.0
+      - uses: actions-rust-lang/setup-rust-toolchain@b328d6be848e9b620901df2e49d27ad7e5536c0b  # v2.0.0
       - name: install cargo-deny
         run: cargo install cargo-deny --locked
       - name: cargo-deny
@@ -54,7 +54,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: actions-rust-lang/setup-rust-toolchain@c8ff772090ab9d00f7f7bd7b388f3c3032282e3b  # v2.0.0
+      - uses: actions-rust-lang/setup-rust-toolchain@b328d6be848e9b620901df2e49d27ad7e5536c0b  # v2.0.0
       - name: outdated
         run: |
           cargo install cargo-outdated --locked 2>/dev/null || true
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 895ad2c..5447fc1 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -46,7 +46,7 @@ jobs:
       CRATE_PAYLOAD_LIMIT_BYTES: 10485760 # 10 MiB
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: actions-rust-lang/setup-rust-toolchain@c8ff772090ab9d00f7f7bd7b388f3c3032282e3b  # v2.0.0
+      - uses: actions-rust-lang/setup-rust-toolchain@b328d6be848e9b620901df2e49d27ad7e5536c0b  # v2.0.0
 
       - name: verify + test
         run: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fae5c92..12318c5 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -59,7 +59,7 @@ jobs:
     continue-on-error: ${{ matrix.target == 'aarch64-pc-windows-msvc' }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: actions-rust-lang/setup-rust-toolchain@c8ff772090ab9d00f7f7bd7b388f3c3032282e3b  # v2.0.0
+      - uses: actions-rust-lang/setup-rust-toolchain@b328d6be848e9b620901df2e49d27ad7e5536c0b  # v2.0.0
         with:
           target: ${{ matrix.target }}
           # See ci.yml: the musl BoringSSL link emits a benign linker path
diff --git a/.github/workflows/replay.yml b/.github/workflows/replay.yml
index c3f35cd..aa1d7f6 100644
--- a/.github/workflows/replay.yml
+++ b/.github/workflows/replay.yml
@@ -31,7 +31,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: actions-rust-lang/setup-rust-toolchain@c8ff772090ab9d00f7f7bd7b388f3c3032282e3b  # v2.0.0
+      - uses: actions-rust-lang/setup-rust-toolchain@b328d6be848e9b620901df2e49d27ad7e5536c0b  # v2.0.0
       - name: build
         run: cargo build --release -p ocserve
       - name: replay against the frozen corpus