diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
index 81c9cff..166b80d 100644
--- a/.github/workflows/codeql.yaml
+++ b/.github/workflows/codeql.yaml
@@ -46,11 +46,11 @@ jobs:
         with:
           go-version-file: go.mod
 
-      - uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
+      - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
         with:
           languages: ${{ matrix.language }}
           config-file: ./.github/codeql/codeql-config.yml
 
-      - uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
+      - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 2aa75e7..8208b59 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -146,7 +146,7 @@ jobs:
       # execution — but binfmt registration is needed so buildx
       # recognises linux/arm64 and linux/riscv64 as valid platforms.
       - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
-      - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4
+      - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
 
       # Logins for the three image registries. Quay/Docker Hub are
       # skipped if their token is missing, mirroring the previous
diff --git a/.github/workflows/scorecard.yaml b/.github/workflows/scorecard.yaml
index 8c0c5e3..75cfc7e 100644
--- a/.github/workflows/scorecard.yaml
+++ b/.github/workflows/scorecard.yaml
@@ -57,6 +57,6 @@ jobs:
       # Surface findings as alerts in the repo's Security tab. The
       # upload-sarif action lives under the codeql-action repo but
       # works for any tool's SARIF output — it isn't tied to CodeQL.
-      - uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
+      - uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
         with:
           sarif_file: results.sarif