diff --git a/.github/workflows/engineering-assets.yml b/.github/workflows/engineering-assets.yml
index 858793d..2990466 100644
--- a/.github/workflows/engineering-assets.yml
+++ b/.github/workflows/engineering-assets.yml
@@ -60,7 +60,7 @@ jobs:
         with:
           fetch-depth: 0               # touchmark reads the hub's whole history
           persist-credentials: false
-      - uses: bedrock-python/touchmark@eb3ccf6e5743898c877d221f3dfeac961fa695eb # v0.5.0
+      - uses: bedrock-python/touchmark@0faa25ae441a73f7da9b73bbbf4b24010bc7df2b # v0.6.0
         with:
           command: check
 
@@ -85,7 +85,7 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: bedrock-python/touchmark@eb3ccf6e5743898c877d221f3dfeac961fa695eb # v0.5.0
+      - uses: bedrock-python/touchmark@0faa25ae441a73f7da9b73bbbf4b24010bc7df2b # v0.6.0
         with:
           command: plan
           # Without the read key (Dependabot's pull requests, and those
@@ -141,7 +141,7 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: bedrock-python/touchmark@eb3ccf6e5743898c877d221f3dfeac961fa695eb # v0.5.0
+      - uses: bedrock-python/touchmark@0faa25ae441a73f7da9b73bbbf4b24010bc7df2b # v0.6.0
         with:
           command: distribute
         env:
@@ -171,7 +171,7 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: bedrock-python/touchmark@eb3ccf6e5743898c877d221f3dfeac961fa695eb # v0.5.0
+      - uses: bedrock-python/touchmark@0faa25ae441a73f7da9b73bbbf4b24010bc7df2b # v0.6.0
         with:
           command: doctor
         env:
diff --git a/README.md b/README.md
index 5cb9cf7..9c5b309 100644
--- a/README.md
+++ b/README.md
@@ -58,7 +58,7 @@ The way a new organisation would:
 
 The repository is public: the organisation is on GitHub Free, where environment secrets exist only in public repositories, and without them the write key cannot be limited to `master`. A ruleset protects `master`: changes only through pull requests with an approving review and a review from Code Owners, no force pushes, no deletion. GitHub doesn't let anyone approve their own pull request, so organisation admins may merge a pull request without them. GitHub Actions were off until the first run ([Rollout](#rollout)); the workflow's `check` job is a required status check, and its default token is read-only.
 
-touchmark is pinned to v0.5.0: the Action in `.github/workflows/engineering-assets.yml` by the commit of its tag, `# v0.5.0` after it. The Action at that commit runs the image of v0.5.0 by digest once it has verified the image's build provenance, so there is no image digest to pin here. Dependabot proposes the next release.
+touchmark is pinned to v0.6.0: the Action in `.github/workflows/engineering-assets.yml` by the commit of its tag, `# v0.6.0` after it. The Action at that commit runs the image of v0.6.0 by digest once it has verified the image's build provenance, so there is no image digest to pin here. Dependabot proposes the next release.
 
 **The GitHub Apps.** Both are installed on the 13 libraries only (*Only select repositories*), never on this hub, with no webhook:
 - `bedrock-python-assets-read`: Metadata, Contents and Pull requests read-only;
diff --git a/scripts/validate.sh b/scripts/validate.sh
index c56579c..b95bce7 100755
--- a/scripts/validate.sh
+++ b/scripts/validate.sh
@@ -24,7 +24,7 @@
 #
 # Tools:
 #   TOUCHMARK   the command that runs touchmark (default: touchmark), for
-#               example "go run github.com/bedrock-python/touchmark/cmd/touchmark@v0.5.0"
+#               example "go run github.com/bedrock-python/touchmark/cmd/touchmark@v0.6.0"
 #   ACTIONLINT  the command that runs actionlint (default: actionlint, else
 #               its official image through docker)
 #