diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index b954b37..c779c8a 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -35,12 +35,12 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+      - uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
         with:
           languages: ${{ matrix.language }}
           # with "autobuild", the analysis below runs the build itself
           build-mode: ${{ matrix.build-mode }}
-      - uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+      - uses: github/codeql-action/analyze@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
         with:
           category: /language:${{ matrix.language }}
           upload: ${{ inputs.upload }}
diff --git a/.github/workflows/stack-dotnet.yml b/.github/workflows/stack-dotnet.yml
index d0a2f72..b2ebe30 100644
--- a/.github/workflows/stack-dotnet.yml
+++ b/.github/workflows/stack-dotnet.yml
@@ -54,7 +54,7 @@ jobs:
             node -e 'for (const v of JSON.parse(process.env.VERSIONS)) console.log(v)'
             echo "EOF"
           } >> "$GITHUB_OUTPUT"
-      - uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
+      - uses: actions/setup-dotnet@0f4a354dd5547a28c70b7853dbd95d5b67886e73 # v6.1.0
         with:
           dotnet-version: ${{ steps.sdks.outputs.list }}
       - name: Run checks
diff --git a/.github/workflows/stack-java.yml b/.github/workflows/stack-java.yml
index f23c120..58fd26f 100644
--- a/.github/workflows/stack-java.yml
+++ b/.github/workflows/stack-java.yml
@@ -50,7 +50,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
+      - uses: actions/setup-java@77dd5b2ce225ea11469928ac317850245a74ae78 # v6.2.0
         with:
           distribution: temurin
           java-version: ${{ matrix.java }}
diff --git a/.github/workflows/stack-ruby.yml b/.github/workflows/stack-ruby.yml
index d145c3a..327daf2 100644
--- a/.github/workflows/stack-ruby.yml
+++ b/.github/workflows/stack-ruby.yml
@@ -46,7 +46,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: ruby/setup-ruby@7f797815d8adceb1c412e7abefdd1ab4abc47a5f # v1.335.0
+      - uses: ruby/setup-ruby@de492cf36cbab201753d720ce4f4e336cd688c94 # v1.336.0
         with:
           ruby-version: ${{ matrix.ruby }}
           working-directory: ${{ inputs.working-directory }}
diff --git a/.github/workflows/workflow-lint.yml b/.github/workflows/workflow-lint.yml
index ac16ca0..a0fee85 100644
--- a/.github/workflows/workflow-lint.yml
+++ b/.github/workflows/workflow-lint.yml
@@ -71,7 +71,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
+      - uses: zizmorcore/zizmor-action@45d7276c9ca790aabd705e31ca99c6185c3e76dd # v0.8.1
         with:
           inputs: ${{ inputs.working-directory }}
           # found by zizmor itself at the root; named for a folder below it