diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 886b730dd..6265beb0a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1458,7 +1458,7 @@ jobs:
         # The composer capstones shell out to a real composer; `composer:`
         # pins the release line (1, 2.2 LTS, 2) so the composer.lock grammar
         # the edits assert stays stable across runners.
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: '8.2'
           tools: composer:${{ matrix.composer }}
diff --git a/.github/workflows/composer-compatibility.yml b/.github/workflows/composer-compatibility.yml
index a7ac0a3f1..be95cde99 100644
--- a/.github/workflows/composer-compatibility.yml
+++ b/.github/workflows/composer-compatibility.yml
@@ -112,7 +112,7 @@ jobs:
         with:
           shared-key: dev-${{ matrix.os }}
           save-if: ${{ github.ref == 'refs/heads/main' }}
-      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: ${{ matrix.php }}
           tools: none
@@ -181,9 +181,11 @@ jobs:
         include:
           - {os: macos-latest, composer: '1.10.28', php: '8.1', sha256: 0915af36eb01e3f0e16cd309adff7051832b9ef014e38371756804b20425cd5a}
           - {os: macos-latest, composer: '2.2.30', php: '8.3', sha256: 8c2b4478b64f8f7cdf1574838fdb0033b29049ca821dad452db7a3dcfcdbffc2}
-          # PHP 8.4 on macOS: setup-php 2.37.2 cannot install 8.5 from Homebrew
-          # since PHP 8.6 shipped (every run from 2026-10-07 23:51Z failed in
-          # "Setup PHP"). Ubuntu and Windows keep the 2.10.3 / 8.5 cell.
+          # PHP 8.4 on macOS: setup-php 2.37.2 could not install 8.5 from
+          # Homebrew once PHP 8.6 shipped (every run from 2026-10-07 23:51Z
+          # failed in "Setup PHP"), and from 2026-10-09 00:55Z no version at
+          # all (#1210); 2.40.0 resolves the tap's formula aliases first.
+          # Ubuntu and Windows keep the 2.10.3 / 8.5 cell.
           - {os: macos-latest, composer: '2.10.3', php: '8.4', sha256: 7a2d379d5b8ffdaa028580ef26494c36d2feef4b178d3dd1473a4dbc5e17c8d6}
     runs-on: ${{ matrix.os }}
     timeout-minutes: 60