diff --git a/.github/actions/environment/action.yml b/.github/actions/environment/action.yml
index d4eccbb90c..db5853c749 100644
--- a/.github/actions/environment/action.yml
+++ b/.github/actions/environment/action.yml
@@ -55,7 +55,7 @@ runs:
 
     - name: Setup Android SDK
       if: ${{ !matrix.container }}
-      uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1
+      uses: android-actions/setup-android@be39fa834029ff78f1a44aa3bb0819b8fc2bd8fd # v4.0.4
       with:
         # Exclude "tools" because the emulator is not needed (nor available for Windows/Linux ARM64)
         packages: platform-tools platforms;android-35 platforms;android-36 build-tools;36.0.0
diff --git a/.github/actions/freediskspace/action.yml b/.github/actions/freediskspace/action.yml
index d024265359..f254972d5b 100644
--- a/.github/actions/freediskspace/action.yml
+++ b/.github/actions/freediskspace/action.yml
@@ -6,7 +6,7 @@ runs:
 
     - name: Free Disk Space
       if: runner.os == 'Linux'
-      uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
+      uses: jlumbroso/free-disk-space@ceedf095f4ec1a097402bc6bd80831f2e1a6fde6 # v2.0.0
       with:
         android: false
         dotnet: false
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 700b863587..88b6922aa8 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -249,7 +249,7 @@ jobs:
         run: dotnet test ${{ matrix.slnf }} -c Release --no-build --nologo -l GitHubActions -l "trx;LogFilePrefix=testresults_${{ runner.os }}" --collect "XPlat Code Coverage"
 
       - name: Upload code coverage
-        uses: codecov/codecov-action@0b35c9ecc4f0529d0eb674914510c22f85b196b4 # v7.1.0
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
 
diff --git a/.github/workflows/changelog-preview.yml b/.github/workflows/changelog-preview.yml
index 7ac153e4d8..49cd9816b2 100644
--- a/.github/workflows/changelog-preview.yml
+++ b/.github/workflows/changelog-preview.yml
@@ -16,5 +16,5 @@ permissions:
 jobs:
   changelog-preview:
     if: false
-    uses: getsentry/craft/.github/workflows/changelog-preview.yml@55694f8bf3a0fd051e21a877f57b4c0dd8e946bb # 2.31.0
+    uses: getsentry/craft/.github/workflows/changelog-preview.yml@b5451aa5604f399ebaef98c0850bece7d062e288 # 2.31.1
     secrets: inherit
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 8bf8c2ac3e..1c25ee4865 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -35,7 +35,7 @@ jobs:
         uses: ./.github/actions/environment
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
           languages: csharp
 
@@ -49,6 +49,6 @@ jobs:
         run: dotnet build Sentry-CI-CodeQL.slnf --no-restore --nologo
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
           category: '/language:csharp'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f7667c0ab1..ec1360319e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -35,7 +35,7 @@ jobs:
           fetch-depth: 0
 
       - name: Prepare release ${{ github.event.inputs.version }}
-        uses: getsentry/craft@55694f8bf3a0fd051e21a877f57b4c0dd8e946bb # 2.31.0
+        uses: getsentry/craft@b5451aa5604f399ebaef98c0850bece7d062e288 # 2.31.1
         env:
           GITHUB_TOKEN: ${{ steps.token.outputs.token }}
         with: