diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 4db4beb..124ef42 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -14,7 +14,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0
+      - uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1
 
   update:
     runs-on: ubuntu-latest
@@ -24,14 +24,14 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: updatecli/updatecli-action@2ba96047d2977e2883b13af58053529bff23b572 # v2
+      - uses: updatecli/updatecli-action@dacff74364eff019d33da0293b179b36f46b6aae # v2
       - run: updatecli pipeline diff --config ./updatecli/updatecli.d
         env:
           UPDATECLI_GITHUB_ACTOR: ${{ github.actor }}
           UPDATECLI_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   build:
-    uses: docker/github-builder/.github/workflows/build.yml@3415a188caae9a0da7fba83bc06985776e0b1790 # v1.14.0
+    uses: docker/github-builder/.github/workflows/build.yml@27ade872c1e2296e62ef15ab3b10d37665e57cf7 # v1.15.0
     permissions:
       contents: read
       id-token: write
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6ca87c3..ecdcd5c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -14,7 +14,7 @@ jobs:
       id-token: write
     steps:
       - id: load-registry-credentials
-        uses: 1password/load-secrets-action@3a12b0ab99d9cd590a3e9b5a90ea017210ed9556 # v4.0.1
+        uses: 1password/load-secrets-action@eb2efd0703da22a93c467f2d1ffbb6826c11e19c # v4.1.1
         with:
           export-env: false
           version: 2.33.1
@@ -25,13 +25,13 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+      - uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
-      - uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+      - uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
         with:
           registry: r.planetary-quantum.com
           username: ${{ steps.load-registry-credentials.outputs.REGISTRY_USERNAME }}
diff --git a/.github/workflows/update-cdp.yml b/.github/workflows/update-cdp.yml
index f65b14e..975d5ca 100644
--- a/.github/workflows/update-cdp.yml
+++ b/.github/workflows/update-cdp.yml
@@ -16,7 +16,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: updatecli/updatecli-action@2ba96047d2977e2883b13af58053529bff23b572 # v2
+      - uses: updatecli/updatecli-action@dacff74364eff019d33da0293b179b36f46b6aae # v2
       - run: updatecli pipeline diff --config ./updatecli/updatecli.d
         env:
           UPDATECLI_GITHUB_ACTOR: ${{ github.actor }}