diff --git a/.github/workflows/pr-check-stale.yml b/.github/workflows/pr-check-stale.yml
index 7c29077..48a6195 100644
--- a/.github/workflows/pr-check-stale.yml
+++ b/.github/workflows/pr-check-stale.yml
@@ -20,7 +20,7 @@ jobs:
         runs-on: [self-hosted, Linux, X64, aws-india, blacksmith-2vcpu-ubuntu-2404, hetzner]
         steps:
             - name: Mark stale issues and pull requests
-              uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
+              uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
               with:
                   repo-token: ${{ secrets.GITHUB_TOKEN }}
                   days-before-issue-stale: 21
diff --git a/.github/workflows/sec-audit.yml b/.github/workflows/sec-audit.yml
index b93cf83..b93114f 100644
--- a/.github/workflows/sec-audit.yml
+++ b/.github/workflows/sec-audit.yml
@@ -118,7 +118,7 @@ jobs:
                     --output-md artifacts/deny-policy-guard.md \
                     --fail-on-violation
 
-            - uses: EmbarkStudios/cargo-deny-action@3fd3802e88374d3fe9159b834c7714ec57d6c979 # v2
+            - uses: EmbarkStudios/cargo-deny-action@6c8f9facfa5047ec02d8485b6bf52b587b7777d1 # v2
               with:
                   command: check advisories licenses sources
 
@@ -328,7 +328,7 @@ jobs:
 
             - name: Upload gitleaks SARIF
               if: always()
-              uses: github/codeql-action/upload-sarif@0d579ffd059c29b07949a3cce3983f0780820c98 # v4
+              uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4
               with:
                   sarif_file: artifacts/gitleaks.sarif
                   category: gitleaks
diff --git a/.github/workflows/sec-codeql.yml b/.github/workflows/sec-codeql.yml
index dfce50d..261bdb6 100644
--- a/.github/workflows/sec-codeql.yml
+++ b/.github/workflows/sec-codeql.yml
@@ -52,7 +52,7 @@ jobs:
                   fetch-depth: 0
 
             - name: Initialize CodeQL
-              uses: github/codeql-action/init@0d579ffd059c29b07949a3cce3983f0780820c98 # v4
+              uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4
               with:
                   languages: rust
                   config-file: ./.github/codeql/codeql-config.yml
@@ -67,6 +67,6 @@ jobs:
               run: cargo build --workspace --all-targets --locked
 
             - name: Perform CodeQL Analysis
-              uses: github/codeql-action/analyze@0d579ffd059c29b07949a3cce3983f0780820c98 # v4
+              uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4
               with:
                   category: "/language:rust"