diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index f3546be..548b150 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -51,7 +51,7 @@ jobs:
           cache: true
 
       - name: Initialise CodeQL
-        uses: github/codeql-action/init@6f5948dfacef28e207b48d0905cf90c03365536d # v3.37.9
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           languages: go
           queries: security-and-quality
@@ -62,6 +62,6 @@ jobs:
         run: go build ./...
 
       - name: Analyse
-        uses: github/codeql-action/analyze@6f5948dfacef28e207b48d0905cf90c03365536d # v3.37.9
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           category: "/language:go"
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 9a0fb0a..c40b91c 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -50,11 +50,11 @@ jobs:
           persist-credentials: false
 
       - name: Run analysis
-        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
         with:
           results_file: results.sarif
           results_format: sarif
-          # publish_results=true sends the score to api.securityscorecards.dev
+          # publish_results=true sends the score to api.scorecard.dev
           # which powers the README badge and the public scorecard.dev site.
           # Disable if you ever fork this workflow into a private mirror.
           publish_results: true
@@ -67,6 +67,6 @@ jobs:
           retention-days: 5
 
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@6f5948dfacef28e207b48d0905cf90c03365536d # v3.37.9
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: results.sarif
diff --git a/README.md b/README.md
index 0fb4db5..27f76c1 100644
--- a/README.md
+++ b/README.md
@@ -3,7 +3,7 @@
 [![Test](https://github.com/amagioss/OpenTAMS/actions/workflows/test.yml/badge.svg?branch=main)](https://github.com/amagioss/OpenTAMS/actions/workflows/test.yml)
 [![Lint](https://github.com/amagioss/OpenTAMS/actions/workflows/lint.yml/badge.svg?branch=main)](https://github.com/amagioss/OpenTAMS/actions/workflows/lint.yml)
 [![Build](https://github.com/amagioss/OpenTAMS/actions/workflows/build.yml/badge.svg?branch=main)](https://github.com/amagioss/OpenTAMS/actions/workflows/build.yml)
-[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/amagioss/opentams/badge)](https://scorecard.dev/viewer/?uri=github.com/amagioss/opentams)
+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/amagioss/opentams/badge)](https://scorecard.dev/viewer/?uri=github.com/amagioss/opentams)
 [![License: Apache 2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](LICENSE)
 [![Go Version](https://img.shields.io/badge/go-1.26-00ADD8?logo=go)](go.mod)
 [![TAMS Spec](https://img.shields.io/badge/TAMS-v8.0-5C2D91)](https://bbc.github.io/tams/main/index.html)