diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
index 08672e4..c20148f 100644
--- a/.github/workflows/codeql.yaml
+++ b/.github/workflows/codeql.yaml
@@ -19,4 +19,4 @@ jobs:
       actions: read
       contents: read
       security-events: write
-    uses: thingzio/actions/.github/workflows/codeql-go.yaml@368b3e12df4c41d9079b26e41a03efcd90461d56  # v1.7.1
+    uses: thingzio/actions/.github/workflows/codeql-go.yaml@7276775800dbfef1d9671e60c337f3b4b479a4e8  # v1.8.0
diff --git a/.github/workflows/deploy-cloud-run.yaml b/.github/workflows/deploy-cloud-run.yaml
index bb10a4a..eff9990 100644
--- a/.github/workflows/deploy-cloud-run.yaml
+++ b/.github/workflows/deploy-cloud-run.yaml
@@ -27,7 +27,7 @@ jobs:
     permissions:
       contents: read
       id-token: write
-    uses: thingzio/actions/.github/workflows/deploy-cloud-run.yaml@368b3e12df4c41d9079b26e41a03efcd90461d56  # v1.7.1
+    uses: thingzio/actions/.github/workflows/deploy-cloud-run.yaml@7276775800dbfef1d9671e60c337f3b4b479a4e8  # v1.8.0
     with:
       # Named here rather than read from vars.SERVICE_NAME: a job that calls a
       # reusable workflow cannot see environment-scoped variables, and the
diff --git a/.github/workflows/release-on-tag.yaml b/.github/workflows/release-on-tag.yaml
index d7b040b..4f562a8 100644
--- a/.github/workflows/release-on-tag.yaml
+++ b/.github/workflows/release-on-tag.yaml
@@ -27,7 +27,7 @@ jobs:
   # ref. See https://github.com/thingzio/actions/blob/main/docs/verification.md
   build:
     needs: test
-    uses: thingzio/actions/.github/workflows/build-ko.yaml@368b3e12df4c41d9079b26e41a03efcd90461d56  # v1.7.1
+    uses: thingzio/actions/.github/workflows/build-ko.yaml@7276775800dbfef1d9671e60c337f3b4b479a4e8  # v1.8.0
     permissions:
       contents: read
       packages: write      # push to ghcr.io
@@ -52,7 +52,7 @@ jobs:
   # time this returns; only visibility is deferred.
   release:
     needs: test
-    uses: thingzio/actions/.github/workflows/release-go.yaml@368b3e12df4c41d9079b26e41a03efcd90461d56  # v1.7.1
+    uses: thingzio/actions/.github/workflows/release-go.yaml@7276775800dbfef1d9671e60c337f3b4b479a4e8  # v1.8.0
     permissions:
       contents: write      # create the draft release, upload artifacts
       id-token: write      # keyless signing
diff --git a/.github/workflows/test-on-call.yaml b/.github/workflows/test-on-call.yaml
index 52a16fb..052bf4e 100644
--- a/.github/workflows/test-on-call.yaml
+++ b/.github/workflows/test-on-call.yaml
@@ -20,7 +20,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Go Environment
-        uses: thingzio/actions/.github/actions/setup-go@368b3e12df4c41d9079b26e41a03efcd90461d56  # v1.7.1
+        uses: thingzio/actions/.github/actions/setup-go@7276775800dbfef1d9671e60c337f3b4b479a4e8  # v1.8.0
 
       - name: Unit Test
         run: make test
@@ -31,7 +31,7 @@ jobs:
       # fork PRs is reported when the change lands on main.
       - name: Upload Coverage
         if: github.event.pull_request.head.repo.fork != true
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f  # v7.0.0
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5  # v7.1.1
         with:
           flags: unittests
           use_oidc: true
@@ -41,7 +41,7 @@ jobs:
   lint:
     permissions:
       contents: read
-    uses: thingzio/actions/.github/workflows/lint-go.yaml@368b3e12df4c41d9079b26e41a03efcd90461d56  # v1.7.1
+    uses: thingzio/actions/.github/workflows/lint-go.yaml@7276775800dbfef1d9671e60c337f3b4b479a4e8  # v1.8.0
 
   integration:
     runs-on: ubuntu-latest
@@ -69,7 +69,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Go Environment
-        uses: thingzio/actions/.github/actions/setup-go@368b3e12df4c41d9079b26e41a03efcd90461d56  # v1.7.1
+        uses: thingzio/actions/.github/actions/setup-go@7276775800dbfef1d9671e60c337f3b4b479a4e8  # v1.8.0
 
       - name: Postgres Integration Tests
         env:
@@ -102,7 +102,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Go Environment
-        uses: thingzio/actions/.github/actions/setup-go@368b3e12df4c41d9079b26e41a03efcd90461d56  # v1.7.1
+        uses: thingzio/actions/.github/actions/setup-go@7276775800dbfef1d9671e60c337f3b4b479a4e8  # v1.8.0
 
       - name: E2E Test
         env: