diff --git a/.github/workflows/android-ci.yml b/.github/workflows/android-ci.yml
index e580960..c51f445 100644
--- a/.github/workflows/android-ci.yml
+++ b/.github/workflows/android-ci.yml
@@ -36,7 +36,7 @@ jobs:
           packages: 'platform-tools platforms;android-37.0 build-tools;37.0.0'
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@v6
         with:
           # Only main writes to the shared cache, so a pull request cannot poison it.
           cache-read-only: ${{ github.ref != 'refs/heads/main' }}
@@ -44,7 +44,7 @@ jobs:
       - name: Verify the Gradle wrapper is the official one
         # A tampered wrapper JAR executes arbitrary code in every later step, so
         # this runs before anything invokes it.
-        uses: gradle/actions/wrapper-validation@v4
+        uses: gradle/actions/wrapper-validation@v6
 
       - name: Make the wrapper executable
         # Git on Windows does not track the executable bit, so a commit made
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0839333..6408ba1 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -31,12 +31,12 @@ jobs:
           packages: 'platform-tools platforms;android-37.0 build-tools;37.0.0'
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@v6
         with:
           cache-read-only: true
 
       - name: Verify the Gradle wrapper is the official one
-        uses: gradle/actions/wrapper-validation@v4
+        uses: gradle/actions/wrapper-validation@v6
 
       - name: Make the wrapper executable
         # See the note in android-ci.yml: Git on Windows drops the exec bit.