diff --git a/.github/workflows/call-github2gerrit.yaml b/.github/workflows/call-github2gerrit.yaml
index 3a2f291b8d6..2dbf20b0991 100644
--- a/.github/workflows/call-github2gerrit.yaml
+++ b/.github/workflows/call-github2gerrit.yaml
@@ -33,7 +33,7 @@ jobs:
     steps:
       - name: Convert GitHub PR to Gerrit Change
         # yamllint disable-line rule:line-length
-        uses: lfreleng-actions/github2gerrit-action@eda09b839f0dca9abccf4eb9d4569a52b82e4dba # v2.2.1
+        uses: lfreleng-actions/github2gerrit-action@df12d7f11e4765687efefd034d10116b1d8d0f4d # v2.4.0
         with:
           GERRIT_SSH_PRIVKEY_G2G: ${{ secrets.GERRIT_SSH_PRIVKEY_G2G }}
           GERRIT_KNOWN_HOSTS: ${{ vars.GERRIT_KNOWN_HOSTS }}
diff --git a/.github/workflows/gerrit-sonar.yaml b/.github/workflows/gerrit-sonar.yaml
index 110e5697ece..f9acbff0945 100644
--- a/.github/workflows/gerrit-sonar.yaml
+++ b/.github/workflows/gerrit-sonar.yaml
@@ -60,7 +60,7 @@ jobs:
     permissions:
       contents: read
     # yamllint disable-line rule:line-length
-    uses: lfreleng-actions/security-workflows/.github/workflows/sonarqube-cloud.yaml@bdcf7d8d599788e3eb70e2d761c9f6abd49c06e5 # v0.7.0
+    uses: lfreleng-actions/security-workflows/.github/workflows/sonarqube-cloud.yaml@76ea52302203912c2ced87702681da58b447d62e # v0.9.0
     with:
       # Gerrit dispatches carry a refspec and check out the change;
       # the weekly schedule leaves it empty and takes the branch.