diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9f32d75..49c5787 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -91,7 +91,7 @@ jobs:
           sudo env PATH="$PATH" TMPDIR=/tmp
           tests/integration/run_tests.sh "$PWD/build/mount.gitmount"
       - name: Upload binary
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: mount.gitmount-${{ matrix.cxx }}-system
           path: build/mount.gitmount
@@ -153,7 +153,7 @@ jobs:
         run: ctest --test-dir build --output-on-failure -R '^integration$'
       - name: Upload sanitizer binary
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: mount.gitmount-sanitized
           path: build/mount.gitmount
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index cd2fde2..52ba8d7 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -31,13 +31,13 @@ jobs:
           sudo apt-get install -y build-essential pkg-config cmake ninja-build \
             libfuse3-dev libgit2-dev
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@1190a975f95ce23525efb6a3fc21ea29567c1b52 # v3
+        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v3
         with:
           languages: cpp
           queries: security-extended
       - name: Build
-        uses: github/codeql-action/autobuild@1190a975f95ce23525efb6a3fc21ea29567c1b52 # v3
+        uses: github/codeql-action/autobuild@24c54180a607b1449ed407dd24f251e4e9147c8d # v3
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@1190a975f95ce23525efb6a3fc21ea29567c1b52 # v3
+        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v3
         with:
           category: '/language:cpp'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 21876ac..ebbf591 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -78,7 +78,7 @@ jobs:
           echo "PKG=$PKG" >> "$GITHUB_ENV"
 
       - name: Generate SBOM (SPDX)
-        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0
+        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
         with:
           path: ${{ env.PKG }}
           format: spdx-json
@@ -86,7 +86,7 @@ jobs:
           upload-artifact: false
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: dist-${{ matrix.label }}
           path: dist/
@@ -103,7 +103,7 @@ jobs:
       attestations: write
     steps:
       - name: Download artifacts
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           pattern: dist-*
           path: dist