diff --git a/.github/workflows/observable-wpt.yml b/.github/workflows/observable-wpt.yml
index d183ea126a..9dd16f5679 100644
--- a/.github/workflows/observable-wpt.yml
+++ b/.github/workflows/observable-wpt.yml
@@ -52,13 +52,13 @@ jobs:
         run: sudo apt-get update && sudo apt-get install --yes libatspi2.0-dev libcairo2-dev libgirepository1.0-dev pkg-config
 
       - name: Restore pinned WPT runner
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .cache/rxjs-wpt/runner
           key: observable-wpt-runner-${{ runner.os }}-${{ runner.arch }}-python-${{ env.WPT_PYTHON }}-${{ env.WPT_COMMIT }}
 
       - name: Restore pinned browser
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .cache/rxjs-wpt/browser
           key: observable-wpt-browser-${{ runner.os }}-chrome-150.0.7871.126-${{ hashFiles('packages/observable-polyfill/test/wpt/browser-lock.json') }}
@@ -115,7 +115,7 @@ jobs:
         run: sudo apt-get update && sudo apt-get install --yes libatspi2.0-dev libcairo2-dev libgirepository1.0-dev pkg-config
 
       - name: Restore pinned WPT runner
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .cache/rxjs-wpt/runner
           key: observable-wpt-runner-${{ runner.os }}-${{ runner.arch }}-python-${{ env.WPT_PYTHON }}-${{ env.WPT_COMMIT }}