diff --git a/.github/workflows/run-e2e-tests.yml b/.github/workflows/run-e2e-tests.yml
index cd6afc6d2..e62005398 100644
--- a/.github/workflows/run-e2e-tests.yml
+++ b/.github/workflows/run-e2e-tests.yml
@@ -830,7 +830,7 @@ jobs:
       - name: Get Test Secrets from AWS Secret Manager
         if: ${{ needs.validate-inputs.outputs.aws_test_secrets_key }}
         id: aws-test-secrets
-        uses: smartcontractkit/.github/actions/ctf-fetch-aws-secret@921f4b0ca850dd473dcef9082e3169ccbb83cc52 # ctf-fetch-aws-secret@0.0.0
+        uses: smartcontractkit/.github/actions/ctf-fetch-aws-secret@61acf908014e2fe42c04f2a507c79f97eb5f8c4d # ctf-fetch-aws-secret@0.0.0
         with:
           secret_id: ${{ needs.validate-inputs.outputs.aws_test_secrets_key }}
           aws_region: ${{ secrets.QA_AWS_REGION }}
@@ -1155,7 +1155,7 @@ jobs:
       - name: Get Test Secrets from AWS Secret Manager
         if: ${{ needs.validate-inputs.outputs.aws_test_secrets_key }}
         id: aws-test-secrets
-        uses: smartcontractkit/.github/actions/ctf-fetch-aws-secret@921f4b0ca850dd473dcef9082e3169ccbb83cc52 # ctf-fetch-aws-secret@0.0.0
+        uses: smartcontractkit/.github/actions/ctf-fetch-aws-secret@61acf908014e2fe42c04f2a507c79f97eb5f8c4d # ctf-fetch-aws-secret@0.0.0
         with:
           secret_id: ${{ needs.validate-inputs.outputs.aws_test_secrets_key }}
           aws_region: ${{ secrets.QA_AWS_REGION }}
diff --git a/actions/crib-deploy-environment/action.yml b/actions/crib-deploy-environment/action.yml
index 0ca6620d6..41d44dcf4 100644
--- a/actions/crib-deploy-environment/action.yml
+++ b/actions/crib-deploy-environment/action.yml
@@ -244,7 +244,7 @@ runs:
         cache-dependency-path: "${{ github.workspace }}/crib/**/*.sum"
 
     - name: Setup Nix
-      uses: smartcontractkit/.github/actions/setup-nix@4df907a307d91761c15cdff65e508145bdbcfca3 # setup-nix@0.3.0
+      uses: smartcontractkit/.github/actions/setup-nix@0cd5c6fa8a1af642a74a11d0ba26eb92f17b5865 # setup-nix@0.3.0
       with:
         cache-pubkey: ${{ inputs.cache-pubkey }}
         enable-aws: true