diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index add3a78..d50ecb1 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -41,12 +41,12 @@ jobs:
         uses: actions/checkout@v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100)
+        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100)
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100)
+        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.0 (4.38.1 blocked estate-wide; nexia-list#100)
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/comprehensive-quality.yml b/.github/workflows/comprehensive-quality.yml
index c0f7567..b57b6a7 100644
--- a/.github/workflows/comprehensive-quality.yml
+++ b/.github/workflows/comprehensive-quality.yml
@@ -40,7 +40,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7.0.1
       - name: Secret scanning
-        uses: trufflesecurity/trufflehog@v3.97.9
+        uses: trufflesecurity/trufflehog@v3.99.2
         continue-on-error: true
       - name: Dependency vulnerabilities
         run: |
diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml
index 8a96bf9..3cd69a5 100644
--- a/.github/workflows/push-email-notify.yml
+++ b/.github/workflows/push-email-notify.yml
@@ -41,7 +41,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Send push notification email
-        uses: hyperpolymath/smtp-notify-action@v0.3.0
+        uses: hyperpolymath/smtp-notify-action@v0.5.0
         with:
           server_address: ${{ secrets.SMTP_HOST }}
           server_port: ${{ secrets.SMTP_PORT }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1e3bc10..a907c43 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -56,7 +56,7 @@ jobs:
           cd release
           tar -czvf betlang-${{ github.ref_name }}-${{ matrix.target }}.tar.gz *
 
-      - uses: actions/upload-artifact@v7.0.1
+      - uses: actions/upload-artifact@v7.0.2
         with:
           name: betlang-${{ matrix.target }}
           path: release/*.tar.gz
@@ -88,7 +88,7 @@ jobs:
           cd release
           tar -czvf betlang-${{ github.ref_name }}-${{ matrix.target }}.tar.gz *
 
-      - uses: actions/upload-artifact@v7.0.1
+      - uses: actions/upload-artifact@v7.0.2
         with:
           name: betlang-${{ matrix.target }}
           path: release/*.tar.gz
@@ -114,7 +114,7 @@ jobs:
           cd release
           7z a betlang-${{ github.ref_name }}-x86_64-pc-windows-msvc.zip *
 
-      - uses: actions/upload-artifact@v7.0.1
+      - uses: actions/upload-artifact@v7.0.2
         with:
           name: betlang-windows
           path: release/*.zip
@@ -139,7 +139,7 @@ jobs:
           cd build
           tar -czvf bet-lsp-${{ github.ref_name }}.tar.gz erlang-shipment
 
-      - uses: actions/upload-artifact@v7.0.1
+      - uses: actions/upload-artifact@v7.0.2
         with:
           name: bet-lsp
           path: lsp/bet-lsp/build/*.tar.gz
@@ -155,7 +155,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7.0.1
 
-      - uses: actions/download-artifact@v8.0.1
+      - uses: actions/download-artifact@v8.0.2
         with:
           path: artifacts