diff --git a/.github/workflows/publish-crates.yml b/.github/workflows/publish-crates.yml
index e187c6db..7d3cf512 100644
--- a/.github/workflows/publish-crates.yml
+++ b/.github/workflows/publish-crates.yml
@@ -49,7 +49,7 @@ jobs:
           fetch-depth: 0
 
       - name: Install Nix
-        uses: DeterminateSystems/determinate-nix-action@2a0be2498974c2b6327e19780488744384637d88 # v3.21.7
+        uses: DeterminateSystems/determinate-nix-action@d96678350ffd6a456235832eb11e1c491589b7bb # v3.21.8
 
       - name: Verify checked-in release version parity
         shell: bash
diff --git a/.github/workflows/release-sce-macos-arm.yml b/.github/workflows/release-sce-macos-arm.yml
index fb39b518..6f362b28 100644
--- a/.github/workflows/release-sce-macos-arm.yml
+++ b/.github/workflows/release-sce-macos-arm.yml
@@ -28,7 +28,7 @@ jobs:
           ref: ${{ inputs.release_ref }}
 
       - name: Install Nix
-        uses: DeterminateSystems/determinate-nix-action@2a0be2498974c2b6327e19780488744384637d88 # v3.21.7
+        uses: DeterminateSystems/determinate-nix-action@d96678350ffd6a456235832eb11e1c491589b7bb # v3.21.8
 
       - name: Build canonical macOS ARM CLI release artifacts
         run: |
diff --git a/.github/workflows/release-sce.yml b/.github/workflows/release-sce.yml
index cf4485b4..20a23add 100644
--- a/.github/workflows/release-sce.yml
+++ b/.github/workflows/release-sce.yml
@@ -220,7 +220,7 @@ jobs:
           ref: ${{ needs.resolve-release.outputs.tag }}
 
       - name: Install Nix
-        uses: DeterminateSystems/determinate-nix-action@2a0be2498974c2b6327e19780488744384637d88 # v3.21.7
+        uses: DeterminateSystems/determinate-nix-action@d96678350ffd6a456235832eb11e1c491589b7bb # v3.21.8
 
       - name: Download CLI release artifacts
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1