diff --git a/.github/workflows/asf-allowlist.yml b/.github/workflows/asf-allowlist.yml
index ca08323093..1e9c3717db 100644
--- a/.github/workflows/asf-allowlist.yml
+++ b/.github/workflows/asf-allowlist.yml
@@ -32,6 +32,6 @@ jobs:
         with:
           persist-credentials: false
       - name: Check ASF GitHub Actions allowlist
-        uses: apache/infrastructure-actions/allowlist-check@e3e0a2261a9c6d5bdd882802b303f34b1511b6df
+        uses: apache/infrastructure-actions/allowlist-check@b41ca1cbe4d8a214dea50788a0e037184a69ad3f
         with:
           scan-glob: ".github/**/*.y*ml"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4a6a172eca..a8a3153737 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -349,7 +349,7 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-maven-
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
+        uses: gradle/actions/setup-gradle@8da46b539cd8fe6ab27ca75128919a18d757604c # v6.4.1
         with:
           gradle-version: "8.13"
       - name: Install Fory Java and Kotlin JSON artifacts
@@ -663,7 +663,7 @@ jobs:
         java-version: ["17", "25"]
     steps:
       - uses: actions/checkout@v7.0.1
-      - uses: graalvm/setup-graalvm@27b360dbb857524eaf0b4c4cef364d38e5b4f173 # v1.6.7
+      - uses: graalvm/setup-graalvm@f70bc8032f90a104502824a54bcb94b6f01715bc # v1.6.8
         with:
           java-version: ${{ matrix.java-version }}
           distribution: "graalvm"
@@ -690,7 +690,7 @@ jobs:
         java-version: ["17", "25"]
     steps:
       - uses: actions/checkout@v7.0.1
-      - uses: graalvm/setup-graalvm@27b360dbb857524eaf0b4c4cef364d38e5b4f173 # v1.6.7
+      - uses: graalvm/setup-graalvm@f70bc8032f90a104502824a54bcb94b6f01715bc # v1.6.8
         with:
           java-version: ${{ matrix.java-version }}
           distribution: "graalvm"
@@ -714,7 +714,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7.0.1
-      - uses: graalvm/setup-graalvm@27b360dbb857524eaf0b4c4cef364d38e5b4f173 # v1.6.7
+      - uses: graalvm/setup-graalvm@f70bc8032f90a104502824a54bcb94b6f01715bc # v1.6.8
         with:
           java-version: "25"
           distribution: "graalvm"
@@ -785,7 +785,7 @@ jobs:
         with:
           java-version: 11
           distribution: "temurin"
-      - uses: sbt/setup-sbt@ecad189dd245444b9ae0a0cd5922fd938b88906f # v1.5.12
+      - uses: sbt/setup-sbt@b113b960ba361e87e08ce02a390d51871b7ee459 # v1.5.13
         with:
           disk-cache: false
       - name: Install fory java
@@ -812,7 +812,7 @@ jobs:
         uses: actions/setup-python@v7.1.0
         with:
           python-version: 3.11
-      - uses: sbt/setup-sbt@ecad189dd245444b9ae0a0cd5922fd938b88906f # v1.5.12
+      - uses: sbt/setup-sbt@b113b960ba361e87e08ce02a390d51871b7ee459 # v1.5.13
         with:
           disk-cache: false
       - name: Run Scala Xlang Test
@@ -840,7 +840,7 @@ jobs:
         uses: actions/setup-python@v7.1.0
         with:
           python-version: 3.11
-      - uses: sbt/setup-sbt@ecad189dd245444b9ae0a0cd5922fd938b88906f # v1.5.12
+      - uses: sbt/setup-sbt@b113b960ba361e87e08ce02a390d51871b7ee459 # v1.5.13
         with:
           disk-cache: false
       - name: Install Fory Java
diff --git a/.github/workflows/release-jvm-snapshot.yaml b/.github/workflows/release-jvm-snapshot.yaml
index 45d597065e..e8ff665c59 100644
--- a/.github/workflows/release-jvm-snapshot.yaml
+++ b/.github/workflows/release-jvm-snapshot.yaml
@@ -45,7 +45,7 @@ jobs:
           server-id: apache.snapshots.https
           server-username: NEXUS_USERNAME
           server-password: NEXUS_PASSWORD
-      - uses: sbt/setup-sbt@ecad189dd245444b9ae0a0cd5922fd938b88906f # v1.5.12
+      - uses: sbt/setup-sbt@b113b960ba361e87e08ce02a390d51871b7ee459 # v1.5.13
         with:
           disk-cache: false
       - name: Publish Java and Kotlin snapshots