diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1826327f..1dae88be 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -196,7 +196,7 @@ jobs:
           node-version: 22.22.3
       - name: Setup Rust
         if: matrix.suite == 'lynx-stack'
-        uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
       - name: Expose GitHub Runtime
         uses: crazy-max/ghaction-github-runtime@04d248b84655b509d8c44dc1d6f990c879747487 # v4
       # Verdaccio is required for rspack-stack testing.
diff --git a/.github/workflows/rspack-ecosystem-ci-from-commit.yml b/.github/workflows/rspack-ecosystem-ci-from-commit.yml
index d04080ba..a5dc0468 100644
--- a/.github/workflows/rspack-ecosystem-ci-from-commit.yml
+++ b/.github/workflows/rspack-ecosystem-ci-from-commit.yml
@@ -119,7 +119,7 @@ jobs:
           ref: ${{ inputs.commitSHA }}
       - name: Setup Rust
         if: inputs.suite == 'lynx-stack'
-        uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
       - run: pnpm i --frozen-lockfile
       - name: Expose GitHub Runtime
         uses: crazy-max/ghaction-github-runtime@04d248b84655b509d8c44dc1d6f990c879747487 # v4
diff --git a/.github/workflows/rspack-ecosystem-ci-from-pr.yml b/.github/workflows/rspack-ecosystem-ci-from-pr.yml
index 3b798b1e..409973c3 100644
--- a/.github/workflows/rspack-ecosystem-ci-from-pr.yml
+++ b/.github/workflows/rspack-ecosystem-ci-from-pr.yml
@@ -86,7 +86,7 @@ jobs:
           ref: ${{ inputs.branchName }}
       - name: Setup Rust
         if: inputs.suite == 'lynx-stack'
-        uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1
       - run: pnpm i --frozen-lockfile
       - name: Expose GitHub Runtime
         uses: crazy-max/ghaction-github-runtime@04d248b84655b509d8c44dc1d6f990c879747487 # v4