diff --git a/.github/workflows/acceptance.yml b/.github/workflows/acceptance.yml
index 999c9aa..8b2c0a4 100644
--- a/.github/workflows/acceptance.yml
+++ b/.github/workflows/acceptance.yml
@@ -15,7 +15,7 @@ concurrency:
   cancel-in-progress: true
 
 env:
-  RIVET_PIN: b1d05950537f8679b2cfb48aded383c5162c288f
+  RIVET_PIN: 1ebb3ac09ed2e23eeb0a91cbec6e689aac01ab1a
   KEEL_PIN: 0740fdfbdab7bf5dab32232c82f07dd98aa6a196
 
 jobs:
@@ -95,7 +95,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Set up embeddable Racket CS
-        uses: turinglambdaai/rivet/.github/actions/setup-embed-racket@b1d05950537f8679b2cfb48aded383c5162c288f
+        uses: turinglambdaai/rivet/.github/actions/setup-embed-racket@1ebb3ac09ed2e23eeb0a91cbec6e689aac01ab1a
       - name: Install native and pinned Racket dependencies
         shell: bash
         run: |
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7fca7a9..08b52a4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,7 +12,7 @@ permissions:
 # Single source of truth for the rivet pin; every install step below
 # references this so a bump is one edit, not a grep-replace across jobs.
 env:
-  RIVET_PIN: b1d05950537f8679b2cfb48aded383c5162c288f
+  RIVET_PIN: 1ebb3ac09ed2e23eeb0a91cbec6e689aac01ab1a
 
 jobs:
   contract:
@@ -75,7 +75,7 @@ jobs:
       # Builds and caches the embeddable Racket CS runtime and exports
       # RIVET_RACKET_* (rivet's own composite action).
       - name: Set up embeddable Racket CS
-        uses: turinglambdaai/rivet/.github/actions/setup-embed-racket@b1d05950537f8679b2cfb48aded383c5162c288f
+        uses: turinglambdaai/rivet/.github/actions/setup-embed-racket@1ebb3ac09ed2e23eeb0a91cbec6e689aac01ab1a
       # Installed after the embeddable runtime so the catalog dependency
       # closure (cext-lib, crypto-lib, keel) resolves against the minimal
       # build — it ships no packages of its own. db backs taskly's storage;
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f56a992..bb14dfe 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -15,7 +15,7 @@ concurrency:
 # Single source of truth for the rivet pin; every install step below
 # references this so a bump is one edit, not a grep-replace across jobs.
 env:
-  RIVET_PIN: b1d05950537f8679b2cfb48aded383c5162c288f
+  RIVET_PIN: 1ebb3ac09ed2e23eeb0a91cbec6e689aac01ab1a
 
 jobs:
   macos:
@@ -143,7 +143,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Set up embeddable Racket CS
-        uses: turinglambdaai/rivet/.github/actions/setup-embed-racket@b1d05950537f8679b2cfb48aded383c5162c288f
+        uses: turinglambdaai/rivet/.github/actions/setup-embed-racket@1ebb3ac09ed2e23eeb0a91cbec6e689aac01ab1a
       # Installed after the embeddable runtime so the catalog dependency
       # closure (cext-lib, crypto-lib, keel) resolves against the minimal
       # build — it ships no packages of its own. db backs taskly's storage;