diff --git a/.github/workflows/publish-crates.yml b/.github/workflows/publish-crates.yml
index 7970f6ea..e187c6db 100644
--- a/.github/workflows/publish-crates.yml
+++ b/.github/workflows/publish-crates.yml
@@ -49,7 +49,7 @@ jobs:
           fetch-depth: 0
 
       - name: Install Nix
-        uses: DeterminateSystems/determinate-nix-action@629b284231c2a82554b724e357e47fc6020833c8 # v3.21.2
+        uses: DeterminateSystems/determinate-nix-action@2a0be2498974c2b6327e19780488744384637d88 # v3.21.7
 
       - name: Verify checked-in release version parity
         shell: bash
diff --git a/.github/workflows/release-sce-macos-arm.yml b/.github/workflows/release-sce-macos-arm.yml
index 2770405d..fb39b518 100644
--- a/.github/workflows/release-sce-macos-arm.yml
+++ b/.github/workflows/release-sce-macos-arm.yml
@@ -28,7 +28,7 @@ jobs:
           ref: ${{ inputs.release_ref }}
 
       - name: Install Nix
-        uses: DeterminateSystems/determinate-nix-action@629b284231c2a82554b724e357e47fc6020833c8 # v3.21.2
+        uses: DeterminateSystems/determinate-nix-action@2a0be2498974c2b6327e19780488744384637d88 # v3.21.7
 
       - name: Build canonical macOS ARM CLI release artifacts
         run: |
diff --git a/.github/workflows/release-sce.yml b/.github/workflows/release-sce.yml
index f450291f..cf4485b4 100644
--- a/.github/workflows/release-sce.yml
+++ b/.github/workflows/release-sce.yml
@@ -220,7 +220,7 @@ jobs:
           ref: ${{ needs.resolve-release.outputs.tag }}
 
       - name: Install Nix
-        uses: DeterminateSystems/determinate-nix-action@629b284231c2a82554b724e357e47fc6020833c8 # v3.21.2
+        uses: DeterminateSystems/determinate-nix-action@2a0be2498974c2b6327e19780488744384637d88 # v3.21.7
 
       - name: Download CLI release artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1