diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml
index c3377a631..d9d81f203 100644
--- a/.github/workflows/auto-merge.yml
+++ b/.github/workflows/auto-merge.yml
@@ -11,5 +11,5 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
-    uses: go-openapi/ci-workflows/.github/workflows/auto-merge.yml@af4c93f45481ea7d24ac2a9858272cc03daf424e # v0.4.0
+    uses: go-openapi/ci-workflows/.github/workflows/auto-merge.yml@befbc52f24215555cb601b0d824b2987c1d49d0b # v0.4.3
     secrets: inherit
diff --git a/.github/workflows/bump-release.yml b/.github/workflows/bump-release.yml
index abff69bcb..3ac34a7ba 100644
--- a/.github/workflows/bump-release.yml
+++ b/.github/workflows/bump-release.yml
@@ -32,7 +32,7 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
-    uses: go-openapi/ci-workflows/.github/workflows/bump-release-monorepo.yml@af4c93f45481ea7d24ac2a9858272cc03daf424e # v0.4.0
+    uses: go-openapi/ci-workflows/.github/workflows/bump-release-monorepo.yml@befbc52f24215555cb601b0d824b2987c1d49d0b # v0.4.3
     with:
       bump-type: ${{ inputs.bump-type }}
       tag-message-title: ${{ inputs.tag-message-title }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index b48a31f9a..4438eda04 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -18,5 +18,5 @@ jobs:
     permissions:
       contents: read
       security-events: write
-    uses: go-openapi/ci-workflows/.github/workflows/codeql.yml@af4c93f45481ea7d24ac2a9858272cc03daf424e # v0.4.0
+    uses: go-openapi/ci-workflows/.github/workflows/codeql.yml@befbc52f24215555cb601b0d824b2987c1d49d0b # v0.4.3
     secrets: inherit
diff --git a/.github/workflows/contributors.yml b/.github/workflows/contributors.yml
index 885ae9842..950025cc1 100644
--- a/.github/workflows/contributors.yml
+++ b/.github/workflows/contributors.yml
@@ -14,5 +14,5 @@ jobs:
     permissions:
       pull-requests: write
       contents: write
-    uses: go-openapi/ci-workflows/.github/workflows/contributors.yml@af4c93f45481ea7d24ac2a9858272cc03daf424e # v0.4.0
+    uses: go-openapi/ci-workflows/.github/workflows/contributors.yml@befbc52f24215555cb601b0d824b2987c1d49d0b # v0.4.3
     secrets: inherit
diff --git a/.github/workflows/go-test.yml b/.github/workflows/go-test.yml
index 1053cd2ba..a3fb3b241 100644
--- a/.github/workflows/go-test.yml
+++ b/.github/workflows/go-test.yml
@@ -13,7 +13,7 @@ on:
 
 jobs:
   test:
-    uses: go-openapi/ci-workflows/.github/workflows/go-test-monorepo.yml@af4c93f45481ea7d24ac2a9858272cc03daf424e # v0.4.0
+    uses: go-openapi/ci-workflows/.github/workflows/go-test-monorepo.yml@befbc52f24215555cb601b0d824b2987c1d49d0b # v0.4.3
     with:
       extra-flags: '-tags testcgo,testcolorized' # (1) this is to trigger extra tests in spew, (2) this is to enable integration test for colorized output
     secrets: inherit
diff --git a/.github/workflows/monitor-bot-pr.yml b/.github/workflows/monitor-bot-pr.yml
index 3e5e18eaf..280aff342 100644
--- a/.github/workflows/monitor-bot-pr.yml
+++ b/.github/workflows/monitor-bot-pr.yml
@@ -14,5 +14,5 @@ jobs:
       contents: write
       pull-requests: write
       statuses: read
-    uses: go-openapi/ci-workflows/.github/workflows/monitor-bot-pr.yml@af4c93f45481ea7d24ac2a9858272cc03daf424e # v0.4.0
+    uses: go-openapi/ci-workflows/.github/workflows/monitor-bot-pr.yml@befbc52f24215555cb601b0d824b2987c1d49d0b # v0.4.3
     secrets: inherit
diff --git a/.github/workflows/scanner.yml b/.github/workflows/scanner.yml
index 49969ae6e..27f47cd51 100644
--- a/.github/workflows/scanner.yml
+++ b/.github/workflows/scanner.yml
@@ -15,5 +15,5 @@ jobs:
     permissions:
       contents: read
       security-events: write
-    uses: go-openapi/ci-workflows/.github/workflows/scanner.yml@af4c93f45481ea7d24ac2a9858272cc03daf424e # v0.4.0
+    uses: go-openapi/ci-workflows/.github/workflows/scanner.yml@befbc52f24215555cb601b0d824b2987c1d49d0b # v0.4.3
     secrets: inherit
diff --git a/.github/workflows/tag-release.yml b/.github/workflows/tag-release.yml
index 8b948f63a..698cfd453 100644
--- a/.github/workflows/tag-release.yml
+++ b/.github/workflows/tag-release.yml
@@ -13,7 +13,7 @@ jobs:
     name: Create release
     permissions:
       contents: write
-    uses: go-openapi/ci-workflows/.github/workflows/release.yml@af4c93f45481ea7d24ac2a9858272cc03daf424e # v0.4.0
+    uses: go-openapi/ci-workflows/.github/workflows/release.yml@befbc52f24215555cb601b0d824b2987c1d49d0b # v0.4.3
     with:
       tag: ${{ github.ref_name }}
       is-monorepo: true
diff --git a/.github/workflows/update-doc.yml b/.github/workflows/update-doc.yml
index 1151d385e..c7b061ad4 100644
--- a/.github/workflows/update-doc.yml
+++ b/.github/workflows/update-doc.yml
@@ -33,7 +33,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: '1'
           submodules: recursive
@@ -95,7 +95,7 @@ jobs:
             > testify.yaml
       -
         name: Build site with Hugo
-        uses: crazy-max/ghaction-hugo@58bd8ea36dbac3f6155d275a04e0b55604a93c48 # v3.2.0
+        uses: crazy-max/ghaction-hugo@d629f74d3e4a9da53050610da35a59863ab9b26c # v3.3.0
         with:
           version: v0.153.3  # <- pin the HUGO version, as they often break things
           extended: true
@@ -111,7 +111,7 @@ jobs:
             --source ${{ github.workspace }}/hack/doc-site/hugo"
       -
         name: Upload artifact
-        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: hack/doc-site/hugo/public
 
@@ -131,7 +131,7 @@ jobs:
       -
         name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
       -
         name: Report URL
         run: |
diff --git a/.github/workflows/webhook-announcements.yml b/.github/workflows/webhook-announcements.yml
index a21bb8209..62068c6b5 100644
--- a/.github/workflows/webhook-announcements.yml
+++ b/.github/workflows/webhook-announcements.yml
@@ -50,7 +50,7 @@ on:
 
 jobs:
   announce:
-    uses: go-openapi/ci-workflows/.github/workflows/webhook-announcements.yml@af4c93f45481ea7d24ac2a9858272cc03daf424e # v0.4.0
+    uses: go-openapi/ci-workflows/.github/workflows/webhook-announcements.yml@befbc52f24215555cb601b0d824b2987c1d49d0b # v0.4.3
     with:
       scanned-markdown: README.md
       # On push: normal before..after diff (empty