diff --git a/.github/workflows/check-actions.yml b/.github/workflows/check-actions.yml
index 0d6fe645..d65fa826 100644
--- a/.github/workflows/check-actions.yml
+++ b/.github/workflows/check-actions.yml
@@ -17,7 +17,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Ensure SHA pinned actions
-        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@46cfe808a5f1588656ef299eedd0ce2fd7ec0dcc # v5.0.6
+        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@c5fc58bd0be7a4b94b73ce40250322d5b838a108 # v5.0.7
         with:
           # slsa-github-generator requires using a semver tag for reusable workflows.
           # See: https://github.com/slsa-framework/slsa-github-generator#referencing-slsa-builders-and-generators
diff --git a/hack/distro/monitoring/kube-prometheus-stack/release.flux.yaml b/hack/distro/monitoring/kube-prometheus-stack/release.flux.yaml
index 1e2724e4..15958a21 100644
--- a/hack/distro/monitoring/kube-prometheus-stack/release.flux.yaml
+++ b/hack/distro/monitoring/kube-prometheus-stack/release.flux.yaml
@@ -13,7 +13,7 @@ spec:
   chart:
     spec:
       chart: kube-prometheus-stack
-      version: "88.1.5"
+      version: "88.2.0"
       sourceRef:
         kind: HelmRepository
         name: kube-prometheus-stack
diff --git a/hack/distro/monitoring/pyroscope/release.flux.yaml b/hack/distro/monitoring/pyroscope/release.flux.yaml
index 4827b30f..326a1027 100644
--- a/hack/distro/monitoring/pyroscope/release.flux.yaml
+++ b/hack/distro/monitoring/pyroscope/release.flux.yaml
@@ -13,7 +13,7 @@ spec:
   chart:
     spec:
       chart: pyroscope
-      version: "2.2.0"
+      version: "2.2.1"
       sourceRef:
         kind: HelmRepository
         name: pyroscope