diff --git a/.github/workflows/capture-wiki-screenshots.yml b/.github/workflows/capture-wiki-screenshots.yml
index 72e8ea2f..3ccf525a 100644
--- a/.github/workflows/capture-wiki-screenshots.yml
+++ b/.github/workflows/capture-wiki-screenshots.yml
@@ -126,7 +126,7 @@ jobs:
         run: npm ci
 
       - name: Cache Playwright browsers
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cache/ms-playwright
           key: playwright-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 466835fb..910d2dc4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -196,7 +196,7 @@ jobs:
         run: npm ci
 
       - name: Cache Playwright browsers
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cache/ms-playwright
           key: playwright-${{ runner.os }}-${{ hashFiles('package-lock.json') }}
@@ -296,9 +296,12 @@ jobs:
         with:
           version: 2.104.0
 
+      # Cold-starting the local stack pulls several images from ghcr.io on a
+      # fresh hosted runner, which has intermittently exceeded 5 minutes and
+      # killed the job (see PRs #449, #456, #459). Give it ample headroom.
       - name: Start local Supabase stack
         run: supabase start
-        timeout-minutes: 5
+        timeout-minutes: 10
 
       - name: Export Supabase credentials
         run: |
diff --git a/.github/workflows/e2e-quarantine.yml b/.github/workflows/e2e-quarantine.yml
index 9e7c1e6f..e7d3d5d1 100644
--- a/.github/workflows/e2e-quarantine.yml
+++ b/.github/workflows/e2e-quarantine.yml
@@ -61,7 +61,7 @@ jobs:
         run: npm ci
 
       - name: Cache Playwright browsers
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cache/ms-playwright
           key: playwright-${{ runner.os }}-${{ hashFiles('package-lock.json') }}