diff --git a/.github/workflows/presubmit.yaml b/.github/workflows/presubmit.yaml
index faf20a6..b4f8582 100644
--- a/.github/workflows/presubmit.yaml
+++ b/.github/workflows/presubmit.yaml
@@ -16,7 +16,7 @@ jobs:
       with:
         persist-credentials: false
     - name: Set up PHP
-      uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+      uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
       with:
         # Uses the min supported version of PHP to avoid introducing or
         # suggesting incompatible syntax.
@@ -39,7 +39,7 @@ jobs:
       with:
         persist-credentials: false
     - name: Set up PHP
-      uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+      uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
       with:
         php-version: ${{ matrix.php-version }}
         tools: composer:v2