diff --git a/.github/workflows/analyze.yml b/.github/workflows/analyze.yml
index 609ca18..480f55f 100644
--- a/.github/workflows/analyze.yml
+++ b/.github/workflows/analyze.yml
@@ -28,7 +28,7 @@ jobs:
           fetch-depth: 0  # Shallow clones should be disabled for a better relevancy of sonar analysis
 
       - name: Set up Java
-        uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1
+        uses: actions/setup-java@6a0805fcefea3d4657a47ac4c165951e33482018 # v4.2.2
         with:
           distribution: 'temurin'
           java-version: 17
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 3b76b74..4f4d1d9 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -23,7 +23,7 @@ jobs:
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
 
       - name: Set up Java ${{ matrix.java }}
-        uses: actions/setup-java@99b8673ff64fbf99d8d325f52d9a5bdedb8483e9 # v4.2.1
+        uses: actions/setup-java@6a0805fcefea3d4657a47ac4c165951e33482018 # v4.2.2
         with:
           distribution: 'zulu'
           java-version: ${{ matrix.java }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 584f5c4..bc7326b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -17,7 +17,7 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 - Bump com.opengamma.strata:strata-basics from 2.12.28 to 2.12.41 (#376, #379, #383, #386, #392, #396, #405, #412).
 - Bump com.google.guava:guava from 32.1.3 to 33.2.1 (#378, #390, #398, #403).
-- Bump actions/setup-java from 3.13.0 to 4.2.1 (#374, #389).
+- Bump actions/setup-java from 3.13.0 to 4.2.2 (#374, #389, #416).
 - Bump actions/cache from 3.3.2 to 4.0.1 (#381, #385, #391).
 - Bump actions/checkout from 4.1.1 to 4.1.7 (#387, #397, #400, #407).
 - Bump github/codeql-action from 2.13.4 to 3.26.0 (#401, #409, #417).