diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index b9a77d7..b7b3e77 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -23,12 +23,12 @@ jobs:
             build_mode: none
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
-      - uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4
+      - uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build_mode }}
       - if: matrix.language == 'c-cpp'
         run: cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Debug -DLS_BUILD_TESTS=ON -DLS_BUILD_LINUX=ON && cmake --build build --parallel
-      - uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4
+      - uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4
         with:
           category: /language:${{ matrix.language }}
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index e448164..9038f36 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -36,7 +36,7 @@ jobs:
       - run: lcov --capture --directory build --rc lcov_branch_coverage=1 --output-file coverage.raw.info --ignore-errors mismatch
       - run: lcov --extract coverage.raw.info '*/src/*' '*/arch/*' '*/ports/*' --rc lcov_branch_coverage=1 --output-file coverage.info --ignore-errors unused
       - run: lcov --summary coverage.info --rc lcov_branch_coverage=1
-      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7
+      - uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7
         if: env.CODECOV_TOKEN != ''
         with:
           files: coverage.info
diff --git a/.github/workflows/osv.yml b/.github/workflows/osv.yml
index ccfbb74..16e4ebc 100644
--- a/.github/workflows/osv.yml
+++ b/.github/workflows/osv.yml
@@ -15,7 +15,7 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Scan dependencies for known vulnerabilities
-        uses: google/osv-scanner-action/osv-scanner-action@9fd1bcce27f67e3bd819a0a7620e332803dc43bc
+        uses: google/osv-scanner-action/osv-scanner-action@8ac9e5ce44cc7178e0e04229a91bdcc003166e57
         with:
           scan-args: |-
             --recursive
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index d298437..c047b6b 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -25,7 +25,7 @@ jobs:
           results_file: results.sarif
           results_format: sarif
           publish_results: true
-      - uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4
+      - uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4
         if: always() && hashFiles('results.sarif') != ''
         with:
           sarif_file: results.sarif