diff --git a/.github/workflows/build-test.yaml b/.github/workflows/build-test.yaml
index 28de88a2..9f7289c7 100644
--- a/.github/workflows/build-test.yaml
+++ b/.github/workflows/build-test.yaml
@@ -34,7 +34,7 @@ jobs:
       - uses: "authzed/actions/setup-go@main"
       - name: "Generate docs"
         run: "go run mage.go gen:docs"
-      - uses: "chainguard-dev/actions/nodiff@8bb24c24be6871bee44f19be55ea11e3b2aea3dd" # main
+      - uses: "chainguard-dev/actions/nodiff@5f020827ba80ff5d64d45116542d0c733e8e7e71" # main
         with:
           path: ""
           fixup-command: "mage gen:docs"
@@ -52,7 +52,7 @@ jobs:
       - name: "Unit tests with coverage"
         run: "go run mage.go test:runWithCoverage"
       - name: "Upload coverage to Codecov"
-        uses: "codecov/codecov-action@v6.0.0"
+        uses: "codecov/codecov-action@v7.0.0"
         with:
           files: "./coverage.txt"
           verbose: true
diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml
index cf6feb9a..20946370 100644
--- a/.github/workflows/docs.yaml
+++ b/.github/workflows/docs.yaml
@@ -71,7 +71,7 @@ jobs:
           GH_TOKEN: "${{ secrets.AUTHZEDAPPROVER_REPO_SCOPED_TOKEN }}"
       - name: "Notify in Slack if failure"
         if: "${{ failure() }}"
-        uses: "slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95" # v3.0.1
+        uses: "slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c" # v3.0.3
         with:
           webhook: "${{ secrets.SLACK_BUILDS_WEBHOOK_URL }}"
           webhook-type: "incoming-webhook"
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index cb905249..ed51867e 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -53,7 +53,7 @@ jobs:
     runs-on: "depot-ubuntu-latest"
     steps:
       - uses: "actions/checkout@v6"
-      - uses: "aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1" # For https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23
+      - uses: "aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25" # For https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23
         with:
           scan-type: "fs"
           ignore-unfixed: true
@@ -104,4 +104,4 @@ jobs:
     if: "github.event_name == 'pull_request' && (github.event.action == 'opened' || github.event.action == 'synchronize' || github.event.action == 'reopened' || github.event.action == 'edited')"
     steps:
       - uses: "actions/checkout@v6"
-      - uses: "webiny/action-conventional-commits@v1.3.1"
+      - uses: "webiny/action-conventional-commits@v1.4.2"
diff --git a/.github/workflows/release-windows.yml b/.github/workflows/release-windows.yml
index 6437381f..b3a733d4 100644
--- a/.github/workflows/release-windows.yml
+++ b/.github/workflows/release-windows.yml
@@ -37,7 +37,7 @@ jobs:
           CHOCOLATEY_API_KEY: "${{ secrets.CHOCOLATEY_API_KEY }}"
       - name: "Notify in Slack if failure"
         if: "${{ failure() }}"
-        uses: "slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95" # v3.0.1
+        uses: "slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c" # v3.0.3
         with:
           webhook: "${{ secrets.SLACK_BUILDS_WEBHOOK_URL }}"
           webhook-type: "incoming-webhook"
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 1a3bbf62..590bd8f5 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -32,7 +32,7 @@ jobs:
           GEMFURY_PUSH_TOKEN: "${{ secrets.GEMFURY_PUSH_TOKEN }}"
       - name: "Notify in Slack if failure"
         if: "${{ failure() }}"
-        uses: "slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95" # v3.0.1
+        uses: "slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c" # v3.0.3
         with:
           webhook: "${{ secrets.SLACK_BUILDS_WEBHOOK_URL }}"
           webhook-type: "incoming-webhook"
@@ -72,7 +72,7 @@ jobs:
           GORELEASER_KEY: "${{ secrets.GORELEASER_KEY }}"
       - name: "Notify in Slack if failure"
         if: "${{ failure() }}"
-        uses: "slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95" # v3.0.1
+        uses: "slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c" # v3.0.3
         with:
           webhook: "${{ secrets.SLACK_BUILDS_WEBHOOK_URL }}"
           webhook-type: "incoming-webhook"