diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8f87c81648..9c5a26081a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -983,7 +983,7 @@ jobs:
           submodules: false
 
       - name: Setup Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.2.0
         with:
           distribution: temurin
           # Keep sdkmanager on the stable JDK path for Linux CI runners.
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 79c041ef72..52a1ace188 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -89,7 +89,7 @@ jobs:
 
       - name: Setup Java
         if: matrix.needs_java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.2.0
         with:
           distribution: temurin
           java-version: "21"