diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 885586b..fe3f5b8 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -6,5 +6,5 @@ on: {pull_request: {}}
 permissions: {contents: read}
 jobs:
   check:
-    uses: katoptra/lib/.github/workflows/check.yml@e18ef7d810f0a239a7f6908f55060d8e0f40ce2c # v2.6.1
+    uses: katoptra/lib/.github/workflows/check.yml@fbe4a0d42066b9f50a2ce5a4938889dd2c52d0f7 # v2.8.0
     with: {offline: true}
diff --git a/.github/workflows/sync.yml b/.github/workflows/sync.yml
index 49c937e..f5bc125 100644
--- a/.github/workflows/sync.yml
+++ b/.github/workflows/sync.yml
@@ -14,7 +14,7 @@ permissions:
 concurrency: {group: sync, cancel-in-progress: false}
 jobs:
   sync:
-    uses: katoptra/lib/.github/workflows/sync.yml@e18ef7d810f0a239a7f6908f55060d8e0f40ce2c # v2.6.1
+    uses: katoptra/lib/.github/workflows/sync.yml@fbe4a0d42066b9f50a2ce5a4938889dd2c52d0f7 # v2.8.0
     # run_budget_minutes in config/mirror.toml is 335, 20 minutes less than this timeout.
     # Thus, the run uploads the last batch and writes the report before the timeout.
     with: {vars: '${{ inputs.vars }}', timeout-minutes: 355}