diff --git a/.github/workflows/helm-release-cd.yaml b/.github/workflows/helm-release-cd.yaml
index 3318a99..0f311e3 100644
--- a/.github/workflows/helm-release-cd.yaml
+++ b/.github/workflows/helm-release-cd.yaml
@@ -117,7 +117,7 @@ jobs:
           fi
 
       - name: Set up Helm
-        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
         with:
           # Keep release packaging on the same vetted Helm v3 patch as validation
           # until we've explicitly audited and adopted Helm v4 behavior.
diff --git a/.github/workflows/helm-test.yaml b/.github/workflows/helm-test.yaml
index 71fa259..8ea53d0 100644
--- a/.github/workflows/helm-test.yaml
+++ b/.github/workflows/helm-test.yaml
@@ -146,7 +146,7 @@ jobs:
 
       - name: Set up Helm
         if: needs.detect.outputs.skip != 'true'
-        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
         with:
           # Stay on Helm v3 (see helm-validate.yaml for the rationale).
           version: "v3.16.3"
diff --git a/.github/workflows/helm-validate.yaml b/.github/workflows/helm-validate.yaml
index 5f29ee2..5c33e4d 100644
--- a/.github/workflows/helm-validate.yaml
+++ b/.github/workflows/helm-validate.yaml
@@ -39,7 +39,7 @@ jobs:
 
       - name: Set up Helm
         if: steps.helm-changes.outputs.helm_changed == 'true'
-        uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
         with:
           # Pin to a specific helm v3 patch. `azure/setup-helm`'s version
           # input is matched verbatim against the upstream tarball name