diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a7e1924..eb401f7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -197,7 +197,7 @@ jobs:
           echo "Generated SBOM from dependency graph"
 
       - name: Attest SBOM
-        uses: actions/attest-sbom@07e74fc4e78d1aad915e867f9a094073a9f71527 # v4.0.0
+        uses: actions/attest-sbom@c604332985a26aa8cf1bdc465b92731239ec6b9e # v4.1.0
         with:
           subject-path: sbom.spdx.json
           sbom-path: sbom.spdx.json
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index c5faa21..bc047e1 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -92,7 +92,7 @@ jobs:
             uploads.github.com:443
 
       - name: Download SARIF artifact
-        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3  # v8.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8.0.1
         with:
           name: scorecard-sarif
 
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 114cfbb..a3abcb8 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -51,7 +51,7 @@ jobs:
           persist-credentials: false
 
       - name: Dependency Review
-        uses: actions/dependency-review-action@05fe4576374b728f0c523d6a13d64c25081e0803 # v4.7.1
+        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.7.1
         with:
           config-file: .github/dependency-review-config.yml