diff --git a/.github/workflows/auto-approve.yml b/.github/workflows/auto-approve.yml
index cabd465..75a417b 100644
--- a/.github/workflows/auto-approve.yml
+++ b/.github/workflows/auto-approve.yml
@@ -42,7 +42,7 @@ jobs:
     steps:
       - name: Mint app token
         id: app
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
diff --git a/.github/workflows/reconcile-rulesets.yml b/.github/workflows/reconcile-rulesets.yml
index 18885b2..16a3bf4 100644
--- a/.github/workflows/reconcile-rulesets.yml
+++ b/.github/workflows/reconcile-rulesets.yml
@@ -60,7 +60,7 @@ jobs:
 
       - name: Mint app token (org-wide)
         id: app
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
diff --git a/.github/workflows/sync-pr-review-board.yml b/.github/workflows/sync-pr-review-board.yml
index bcd4d4f..878305b 100644
--- a/.github/workflows/sync-pr-review-board.yml
+++ b/.github/workflows/sync-pr-review-board.yml
@@ -25,7 +25,7 @@ jobs:
         uses: actions/checkout@v7
 
       - name: Set up Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@v7.1.0
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/sync-security-triage.yml b/.github/workflows/sync-security-triage.yml
index f1478a7..c4849e3 100644
--- a/.github/workflows/sync-security-triage.yml
+++ b/.github/workflows/sync-security-triage.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@v7.1.0
         with:
           python-version: "3.12"
       - name: Sync security triage board
diff --git a/.github/workflows/update-readme.yml b/.github/workflows/update-readme.yml
index 0785836..d1a985d 100644
--- a/.github/workflows/update-readme.yml
+++ b/.github/workflows/update-readme.yml
@@ -17,7 +17,7 @@ jobs:
     steps:
       - name: Mint app token (PR author + push identity)
         id: app
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
@@ -30,7 +30,7 @@ jobs:
           persist-credentials: true
 
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"