diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index be4921ce3..41b10d890 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -1668,7 +1668,7 @@ jobs:
       - name: CI scope regression tests
         run: make test-ci-scope
       - name: zizmor
-        uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
+        uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
         with:
           inputs: .github
           advanced-security: false
diff --git a/.github/workflows/images.yaml b/.github/workflows/images.yaml
index dc4fb6a8c..190d69b2b 100644
--- a/.github/workflows/images.yaml
+++ b/.github/workflows/images.yaml
@@ -61,7 +61,7 @@ jobs:
       # Login only when pushing to registry; skip on PRs to avoid unnecessary token operations.
       # Fork PRs have read-only GITHUB_TOKEN anyway, so login would fail confusingly.
       - if: github.event_name != 'pull_request'
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -141,7 +141,7 @@ jobs:
       # it; the loop confirms every tag resolves to the signed digest.
       - if: github.event_name != 'pull_request'
         name: install oras
-        uses: oras-project/setup-oras@005458ad77f1c8facd38a094e4af2e69e5607ff4 # v2.0.2
+        uses: oras-project/setup-oras@5e2f2482b30b0cb3e14e67f89a80c88c659a7c63 # v2.0.3
       - if: github.event_name != 'pull_request'
         name: attach tags to the signed digest
         env:
@@ -237,7 +237,7 @@ jobs:
       # Login only when pushing to registry; skip on PRs to avoid unnecessary token operations.
       # Fork PRs have read-only GITHUB_TOKEN anyway, so login would fail confusingly.
       - if: github.event_name != 'pull_request'
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -363,7 +363,7 @@ jobs:
       # it; the loop confirms every tag resolves to the signed digest.
       - if: github.event_name != 'pull_request'
         name: install oras
-        uses: oras-project/setup-oras@005458ad77f1c8facd38a094e4af2e69e5607ff4 # v2.0.2
+        uses: oras-project/setup-oras@5e2f2482b30b0cb3e14e67f89a80c88c659a7c63 # v2.0.3
       - if: github.event_name != 'pull_request'
         name: attach tags to the signed digest
         env:
diff --git a/.github/workflows/publish-edge.yaml b/.github/workflows/publish-edge.yaml
index f91e9d12d..aecd23d26 100644
--- a/.github/workflows/publish-edge.yaml
+++ b/.github/workflows/publish-edge.yaml
@@ -112,7 +112,7 @@ jobs:
           fi
       - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
       - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
-      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -236,7 +236,7 @@ jobs:
       # A run that stops or is superseded before this step leaves only an
       # untagged digest behind.
       - name: install oras
-        uses: oras-project/setup-oras@005458ad77f1c8facd38a094e4af2e69e5607ff4 # v2.0.2
+        uses: oras-project/setup-oras@5e2f2482b30b0cb3e14e67f89a80c88c659a7c63 # v2.0.3
       - name: attach edge tags to the signed digest
         env:
           IMAGE: ${{ steps.image.outputs.name }}
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index ba7f864bb..b2e8a0bdc 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -55,7 +55,7 @@ jobs:
           fi
       - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
       - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
-      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -156,7 +156,7 @@ jobs:
       # leg that fails in the resolve loop has already published its tags, so
       # inspect the image's tags before re-running the failed jobs.
       - name: install oras
-        uses: oras-project/setup-oras@005458ad77f1c8facd38a094e4af2e69e5607ff4 # v2.0.2
+        uses: oras-project/setup-oras@5e2f2482b30b0cb3e14e67f89a80c88c659a7c63 # v2.0.3
       - name: attach release tags to the signed digest
         env:
           IMAGE: ${{ steps.image.outputs.name }}
@@ -201,7 +201,7 @@ jobs:
       # cosign sign reads credentials from ~/.docker/config.json, which helm
       # registry login does not populate (it uses HELM_REGISTRY_CONFIG instead).
       # Add docker login to provide cosign with GHCR credentials.
-      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -349,7 +349,7 @@ jobs:
             exit 1
           fi
       - name: install oras
-        uses: oras-project/setup-oras@005458ad77f1c8facd38a094e4af2e69e5607ff4 # v2.0.2
+        uses: oras-project/setup-oras@5e2f2482b30b0cb3e14e67f89a80c88c659a7c63 # v2.0.3
       - name: install cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         with:
@@ -357,7 +357,7 @@ jobs:
       - name: refresh sigstore trust root
         run: cosign initialize
       - name: login to registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
diff --git a/.github/workflows/republish-modules.yaml b/.github/workflows/republish-modules.yaml
index 1459ea2db..22860cd36 100644
--- a/.github/workflows/republish-modules.yaml
+++ b/.github/workflows/republish-modules.yaml
@@ -42,7 +42,7 @@ jobs:
             exit 1
           fi
       - name: install oras
-        uses: oras-project/setup-oras@005458ad77f1c8facd38a094e4af2e69e5607ff4 # v2.0.2
+        uses: oras-project/setup-oras@5e2f2482b30b0cb3e14e67f89a80c88c659a7c63 # v2.0.3
       - name: install cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         with:
@@ -50,7 +50,7 @@ jobs:
       - name: refresh sigstore trust root
         run: cosign initialize
       - name: login to registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}