diff --git a/.github/workflows/agent-task-dispatch.yml b/.github/workflows/agent-task-dispatch.yml
index a26e48e..91d8f1c 100644
--- a/.github/workflows/agent-task-dispatch.yml
+++ b/.github/workflows/agent-task-dispatch.yml
@@ -23,7 +23,7 @@ jobs:
       issues: write # posts one comment with the structural check result; nothing else is written
     steps:
       - name: Harden runner (egress audit)
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed # v2.22.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 0278198..4aa9e01 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -28,7 +28,7 @@ jobs:
       security-events: write # uploads SARIF to code scanning
     steps:
       - name: Harden runner (egress audit)
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed # v2.22.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 2373ff6..4b7ef1b 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -26,7 +26,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Harden runner (egress audit)
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed # v2.22.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/reusable-sbom-provenance.yml b/.github/workflows/reusable-sbom-provenance.yml
index 9a39e3f..8960e8c 100644
--- a/.github/workflows/reusable-sbom-provenance.yml
+++ b/.github/workflows/reusable-sbom-provenance.yml
@@ -47,7 +47,7 @@ jobs:
           persist-credentials: false
 
       - name: Generate SBOM
-        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
+        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
         with:
           path: ${{ inputs.sbom-path }}
           format: ${{ inputs.sbom-format }}
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 66ae64b..60d8abd 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -28,7 +28,7 @@ jobs:
       security-events: write # uploads SARIF to code scanning
     steps:
       - name: Harden runner (egress audit)
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed # v2.22.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/workflow-lint.yml b/.github/workflows/workflow-lint.yml
index f5e733c..279056a 100644
--- a/.github/workflows/workflow-lint.yml
+++ b/.github/workflows/workflow-lint.yml
@@ -26,7 +26,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Harden runner (egress audit)
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed # v2.22.0
         with:
           egress-policy: audit