diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index aae009e..d3cc61d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -206,7 +206,7 @@ jobs:
       # script inside it. The VM runs as root, so the RequiresRoot tests (BPF capture, epair pairs) run
       # instead of skipping; each fixture self-skips where its operation isn't available.
       - name: Build and test in a FreeBSD VM
-        uses: vmactions/freebsd-vm@83b151f58c6047089f4c80eb5ba2039d158ce093 # v1
+        uses: vmactions/freebsd-vm@f0552d3b69211736abd97f02ff3d4674c56b73b1 # v1
         with:
           release: '14.2'  # 14.x base ships clang/libc++ >= 18 (std::println/format/expected); OPNsense 25.x tracks 14.3
           usesh: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ea335a6..2a11612 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -182,7 +182,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Build the static release binary in a FreeBSD VM
-        uses: vmactions/freebsd-vm@83b151f58c6047089f4c80eb5ba2039d158ce093 # v1
+        uses: vmactions/freebsd-vm@f0552d3b69211736abd97f02ff3d4674c56b73b1 # v1
         with:
           release: '14.2'
           arch: ${{ matrix.vm_arch }}