diff --git a/.github/workflows/instant-sync.yml b/.github/workflows/instant-sync.yml
index e888f7c..c30caef 100644
--- a/.github/workflows/instant-sync.yml
+++ b/.github/workflows/instant-sync.yml
@@ -14,7 +14,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Monitor outbound egress
-        uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
+        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
         with:
           egress-policy: audit
       - name: Check propagation credential
diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml
index 1d4d92f..66b0ca4 100644
--- a/.github/workflows/push-email-notify.yml
+++ b/.github/workflows/push-email-notify.yml
@@ -39,7 +39,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Send push notification email
-        uses: hyperpolymath/smtp-notify-action@c1c9fa07992a02c1fd3d67a0dc1b08cccb852aef # v0.5.0
+        uses: hyperpolymath/smtp-notify-action@e384daf6167a7a7567642d6a62060106244d2413 # v0.5.1
         with:
           server_address: ${{ secrets.SMTP_HOST }}
           server_port: ${{ secrets.SMTP_PORT }}