diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index b03c0c8..4db4beb 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -11,27 +11,27 @@ jobs:
       actions: read
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
+      - uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0
 
   update:
     runs-on: ubuntu-latest
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: updatecli/updatecli-action@7fea18dfb6a2d7077cd040e48ed658009bee5c6f # v2
+      - uses: updatecli/updatecli-action@2ba96047d2977e2883b13af58053529bff23b572 # v2
       - run: updatecli pipeline diff --config ./updatecli/updatecli.d
         env:
           UPDATECLI_GITHUB_ACTOR: ${{ github.actor }}
           UPDATECLI_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   build:
-    uses: docker/github-builder/.github/workflows/build.yml@5f637c833aa76bc99372a1dc9a6f8bcd8056fb85 # v1.12.0
+    uses: docker/github-builder/.github/workflows/build.yml@3415a188caae9a0da7fba83bc06985776e0b1790 # v1.14.0
     permissions:
       contents: read
       id-token: write
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3465c64..6ca87c3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -22,7 +22,7 @@ jobs:
           OP_SERVICE_ACCOUNT_TOKEN: ${{ secrets.OP_RUNWAYOSS_SERVICE_ACCOUNT }}
           REGISTRY_USERNAME: "op://RunwayOSS/robot-harbor-quantum-public/username"
           REGISTRY_PASSWORD: "op://RunwayOSS/robot-harbor-quantum-public/password"
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
diff --git a/.github/workflows/update-cdp.yml b/.github/workflows/update-cdp.yml
index 25aaf57..f65b14e 100644
--- a/.github/workflows/update-cdp.yml
+++ b/.github/workflows/update-cdp.yml
@@ -13,10 +13,10 @@ jobs:
   updatecli:
     runs-on: "ubuntu-latest"
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: updatecli/updatecli-action@7fea18dfb6a2d7077cd040e48ed658009bee5c6f # v2
+      - uses: updatecli/updatecli-action@2ba96047d2977e2883b13af58053529bff23b572 # v2
       - run: updatecli pipeline diff --config ./updatecli/updatecli.d
         env:
           UPDATECLI_GITHUB_ACTOR: ${{ github.actor }}