diff --git a/.github/actions/artifact-cache/action.yml b/.github/actions/artifact-cache/action.yml
index 0e14827d0..d4e65f351 100644
--- a/.github/actions/artifact-cache/action.yml
+++ b/.github/actions/artifact-cache/action.yml
@@ -59,7 +59,7 @@ runs:
 
     - name: Restore artifact cache
       id: restore
-      uses: actions/cache@v5
+      uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6
       with:
         path: ${{ steps.prepare.outputs.artifact-path }}
         key: ${{ steps.prepare.outputs.cache-key }}
diff --git a/.github/scripts/__tests__/artifact-cache.test.js b/.github/scripts/__tests__/artifact-cache.test.js
index ba9f653d0..646cc0a63 100644
--- a/.github/scripts/__tests__/artifact-cache.test.js
+++ b/.github/scripts/__tests__/artifact-cache.test.js
@@ -277,5 +277,5 @@ test('action metadata exposes required public inputs and outputs', () => {
   assert.match(metadata, /cache-hit:/);
   assert.match(metadata, /artifact-found:/);
   assert.match(metadata, /artifact-path:/);
-  assert.match(metadata, /actions\/cache@v5/);
+  assert.match(metadata, /actions\/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6/);
 });
diff --git a/.github/workflows/agents-auto-pilot.yml b/.github/workflows/agents-auto-pilot.yml
index 280ce3488..e4ef43b0f 100644
--- a/.github/workflows/agents-auto-pilot.yml
+++ b/.github/workflows/agents-auto-pilot.yml
@@ -222,7 +222,7 @@ jobs:
 
       - name: Cache pip (LLM requirements)
         if: steps.check_enabled.outputs.enabled == 'true'
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6
         with:
           path: |
             ~/.cache/pip
diff --git a/.github/workflows/health-42-actionlint.yml b/.github/workflows/health-42-actionlint.yml
index 9659bdc8a..4974c7c8d 100644
--- a/.github/workflows/health-42-actionlint.yml
+++ b/.github/workflows/health-42-actionlint.yml
@@ -84,7 +84,7 @@ jobs:
 
       - name: Restore cached actionlint
         id: actionlint-cache
-        uses: actions/cache@v5
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6
         with:
           path: ~/.cache/actionlint
           key: actionlint-${{ runner.os }}-${{ env.ACTIONLINT_VERSION }}
@@ -103,7 +103,7 @@ jobs:
 
       - name: Restore cached reviewdog
         id: reviewdog-cache
-        uses: actions/cache@v5
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6
         with:
           path: ~/.cache/reviewdog
           key: reviewdog-${{ runner.os }}-${{ env.REVIEWDOG_VERSION }}
diff --git a/.github/workflows/maint-52-validate-workflows.yml b/.github/workflows/maint-52-validate-workflows.yml
index 0c96b347a..7dcda8203 100644
--- a/.github/workflows/maint-52-validate-workflows.yml
+++ b/.github/workflows/maint-52-validate-workflows.yml
@@ -24,7 +24,7 @@ jobs:
 
       - name: Cache workflow linters
         id: cache-linters
-        uses: actions/cache@v5
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6
         with:
           path: ~/.local/bin
           key: workflow-linters-actionlint-1.7.3-yq-4.44.3
diff --git a/.github/workflows/reusable-10-ci-python.yml b/.github/workflows/reusable-10-ci-python.yml
index b05a910b5..a9634b496 100644
--- a/.github/workflows/reusable-10-ci-python.yml
+++ b/.github/workflows/reusable-10-ci-python.yml
@@ -467,7 +467,7 @@ jobs:
 
       - name: Cache uv artifacts
         if: ${{ inputs.cache }}
-        uses: actions/cache@v5
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6
         with:
           path: |
             ~/.cache/uv
@@ -869,7 +869,7 @@ jobs:
 
       - name: Cache uv artifacts
         if: ${{ inputs.cache }}
-        uses: actions/cache@v5
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6
         with:
           path: |
             ~/.cache/uv
@@ -1190,7 +1190,7 @@ jobs:
 
       - name: Cache uv artifacts
         if: ${{ inputs.cache }}
-        uses: actions/cache@v5
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6
         with:
           path: |
             ~/.cache/uv
@@ -1403,7 +1403,7 @@ jobs:
 
       - name: Cache mypy state
         if: ${{ inputs.cache }}
-        uses: actions/cache@v5
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6
         with:
           path: ${{ inputs['working-directory'] || '.' }}/.mypy_cache
           key: >-
@@ -1544,7 +1544,7 @@ jobs:
 
       - name: Cache uv artifacts
         if: ${{ inputs.cache }}
-        uses: actions/cache@v5
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6
         with:
           path: |
             ~/.cache/uv
@@ -1850,7 +1850,7 @@ jobs:
 
       - name: Cache mypy state
         if: ${{ inputs.cache && inputs.typecheck && inputs['run-mypy'] }}
-        uses: actions/cache@v5
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6
         with:
           path: ${{ inputs['working-directory'] || '.' }}/.mypy_cache
           key: >-
@@ -1864,7 +1864,7 @@ jobs:
 
       - name: Cache pytest state
         if: ${{ inputs.cache }}
-        uses: actions/cache@v5
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6
         with:
           path: ${{ inputs['working-directory'] || '.' }}/.pytest_cache
           key: >-
diff --git a/.github/workflows/reusable-agents-verifier.yml b/.github/workflows/reusable-agents-verifier.yml
index 68772f911..ef388d36a 100644
--- a/.github/workflows/reusable-agents-verifier.yml
+++ b/.github/workflows/reusable-agents-verifier.yml
@@ -667,7 +667,7 @@ jobs:
             steps.context.outputs.should_run == 'true' &&
             inputs.mode == 'evaluate'
           }}
-        uses: actions/cache@v5
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6
         with:
           path: |
             ~/.cache/pip
@@ -976,7 +976,7 @@ jobs:
             steps.context.outputs.should_run == 'true' &&
             inputs.mode == 'compare'
           }}
-        uses: actions/cache@v5
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6
         with:
           path: |
             ~/.cache/pip
diff --git a/agents/codex-1447.md b/agents/codex-1447.md
index f3ebeaabc..b226447da 100644
--- a/agents/codex-1447.md
+++ b/agents/codex-1447.md
@@ -1,5 +1,5 @@
 <!--
 needs-human:
 Label: needs-human
-Workflow updates required in .github/workflows/agents-auto-pilot.yml and .github/workflows/reusable-agents-verifier.yml. Add pinned installs (`pip install -r tools/requirements-llm.txt` and `pip install -r .workflows-lib/tools/requirements-llm.txt` for evaluate/compare), add actions/cache@v5 pip cache keyed by Python version + requirements hash (`${{ hashFiles('tools/requirements-llm.txt') }}` and `${{ hashFiles('.workflows-lib/tools/requirements-llm.txt') }}`), and remove any floating `pip install langchain*` lines. Workflow edits require agent-high-privilege.
+Workflow updates required in .github/workflows/agents-auto-pilot.yml and .github/workflows/reusable-agents-verifier.yml. Add pinned installs (`pip install -r tools/requirements-llm.txt` and `pip install -r .workflows-lib/tools/requirements-llm.txt` for evaluate/compare), add actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 pip cache keyed by Python version + requirements hash (`${{ hashFiles('tools/requirements-llm.txt') }}` and `${{ hashFiles('.workflows-lib/tools/requirements-llm.txt') }}`), and remove any floating `pip install langchain*` lines. Workflow edits require agent-high-privilege.
 -->
diff --git a/templates/consumer-repo/.github/actions/artifact-cache/action.yml b/templates/consumer-repo/.github/actions/artifact-cache/action.yml
index 0e14827d0..d4e65f351 100644
--- a/templates/consumer-repo/.github/actions/artifact-cache/action.yml
+++ b/templates/consumer-repo/.github/actions/artifact-cache/action.yml
@@ -59,7 +59,7 @@ runs:
 
     - name: Restore artifact cache
       id: restore
-      uses: actions/cache@v5
+      uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6
       with:
         path: ${{ steps.prepare.outputs.artifact-path }}
         key: ${{ steps.prepare.outputs.cache-key }}
diff --git a/templates/consumer-repo/.github/workflows/agents-auto-pilot.yml b/templates/consumer-repo/.github/workflows/agents-auto-pilot.yml
index 280ce3488..e4ef43b0f 100644
--- a/templates/consumer-repo/.github/workflows/agents-auto-pilot.yml
+++ b/templates/consumer-repo/.github/workflows/agents-auto-pilot.yml
@@ -222,7 +222,7 @@ jobs:
 
       - name: Cache pip (LLM requirements)
         if: steps.check_enabled.outputs.enabled == 'true'
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6
         with:
           path: |
             ~/.cache/pip
diff --git a/tests/workflows/test_workflow_llm_installs.py b/tests/workflows/test_workflow_llm_installs.py
index 2ee65995e..1fc9b9ba1 100644
--- a/tests/workflows/test_workflow_llm_installs.py
+++ b/tests/workflows/test_workflow_llm_installs.py
@@ -22,6 +22,7 @@
     "gpt-5.5": (0, 125, 0),
     "gpt-5.4": (0, 125, 0),
 }
+ACTIONS_CACHE_V6_REF = "actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8"
 
 
 def _load_text(path: Path) -> str:
@@ -98,14 +99,14 @@ def _assert_pip_cache(workflow: dict, hash_path: str, name: str) -> None:
     expected_hash = f"hashFiles('{hash_path}')"
     expected_hash_alt = f'hashFiles("{hash_path}")'
     for step in _iter_steps(workflow):
-        if step.get("uses") != "actions/cache@v5":
+        if step.get("uses") != ACTIONS_CACHE_V6_REF:
             continue
         with_block = step.get("with") or {}
         key = str(with_block.get("key", ""))
         if (expected_hash in key or expected_hash_alt in key) and "python-version" in key:
             return
     raise AssertionError(
-        f"{name} must include actions/cache@v5 step with key using python-version and hashFiles('{hash_path}')."
+        f"{name} must include {ACTIONS_CACHE_V6_REF} step with key using python-version and hashFiles('{hash_path}')."
     )
 
 
@@ -290,7 +291,7 @@ def test_workflow_llm_needs_human_comment_documents_blocker() -> None:
         "Label: needs-human",
         ".github/workflows/agents-auto-pilot.yml",
         ".github/workflows/reusable-agents-verifier.yml",
-        "actions/cache@v5",
+        ACTIONS_CACHE_V6_REF,
         "tools/requirements-llm.txt",
         ".workflows-lib/tools/requirements-llm.txt",
         "langchain",