diff --git a/actions.yml b/actions.yml
index be641ed8..aa1e7a9c 100644
--- a/actions.yml
+++ b/actions.yml
@@ -486,9 +486,15 @@ dorny/test-reporter:
   a43b3a5f7366b97d083190328d2c652e1a8b6aa2:
     tag: v3.0.0
 dtolnay/rust-toolchain:
+  # Deliberately carries no `tag:` annotation. Upstream publishes `stable` as a
+  # rolling branch that is force-pushed on each toolchain release, so a SHA
+  # annotated with it stops being an ancestor of that branch and makes
+  # check_action_tags hard-fail every PR in this repo, not just ones touching
+  # this entry. The commit itself is immutable and still valid to pin; moving
+  # to whatever `stable` points at now is a version bump and needs its own
+  # review rather than being smuggled in as a CI fix.
   4cda84d5c5c54efe2404f9d843567869ab1699d4:
     keep: true
-    tag: stable
 easimon/maximize-build-space:
   '*':
     keep: true
diff --git a/approved_patterns.yml b/approved_patterns.yml
index a20b261b..d7e6b61c 100644
--- a/approved_patterns.yml
+++ b/approved_patterns.yml
@@ -379,7 +379,6 @@
 - vapier/coverity-scan-action@2068473c7bdf8c2fb984a6a40ae76ee7facd7a85
 - vimtor/action-zip@5f1c4aa587ea41db1110df6a99981dbe19cee310
 - vishalsinha21/dynamic-checklist@*
-- zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e
 - zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d
 - zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa
 - zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02