diff --git a/.github/workflows/publish-crates.yml b/.github/workflows/publish-crates.yml
index d498e345..be73e351 100644
--- a/.github/workflows/publish-crates.yml
+++ b/.github/workflows/publish-crates.yml
@@ -49,7 +49,7 @@ jobs:
           fetch-depth: 0
 
       - name: Install Nix
-        uses: DeterminateSystems/determinate-nix-action@d96678350ffd6a456235832eb11e1c491589b7bb # v3.21.8
+        uses: DeterminateSystems/determinate-nix-action@61cbfe2efc2d4e7a8a6d56967c3c1058e846c858 # v3.21.9
 
       - name: Verify checked-in release version parity
         shell: bash
diff --git a/.github/workflows/release-sce-macos-arm.yml b/.github/workflows/release-sce-macos-arm.yml
index a018a83a..c21c5eca 100644
--- a/.github/workflows/release-sce-macos-arm.yml
+++ b/.github/workflows/release-sce-macos-arm.yml
@@ -28,7 +28,7 @@ jobs:
           ref: ${{ inputs.release_ref }}
 
       - name: Install Nix
-        uses: DeterminateSystems/determinate-nix-action@d96678350ffd6a456235832eb11e1c491589b7bb # v3.21.8
+        uses: DeterminateSystems/determinate-nix-action@61cbfe2efc2d4e7a8a6d56967c3c1058e846c858 # v3.21.9
 
       - name: Build canonical macOS ARM CLI release artifacts
         run: |
diff --git a/.github/workflows/release-sce.yml b/.github/workflows/release-sce.yml
index 1ef71239..2a1282fa 100644
--- a/.github/workflows/release-sce.yml
+++ b/.github/workflows/release-sce.yml
@@ -220,7 +220,7 @@ jobs:
           ref: ${{ needs.resolve-release.outputs.tag }}
 
       - name: Install Nix
-        uses: DeterminateSystems/determinate-nix-action@d96678350ffd6a456235832eb11e1c491589b7bb # v3.21.8
+        uses: DeterminateSystems/determinate-nix-action@61cbfe2efc2d4e7a8a6d56967c3c1058e846c858 # v3.21.9
 
       - name: Download CLI release artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1