diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 32a4339b..4cb7ac2b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -40,7 +40,7 @@ jobs:
 
             - name: Detect changed paths
               id: filter
-              uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3
+              uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
               with:
                   filters: |
                       compiler:
@@ -137,7 +137,7 @@ jobs:
 
             - name: Upload coverage to Codecov
               if: always() && hashFiles('coverage/lcov.info') != ''
-              uses: codecov/codecov-action@b9fd7d16f6d7d1b5d2bec1a2887e65ceed900238 # v4
+              uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
               continue-on-error: true
               with:
                   files: coverage/lcov.info
diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index befff75c..82e0045f 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -72,7 +72,7 @@ jobs:
       # https://github.com/sigstore/cosign-installer
       - name: Install cosign
         if: github.event_name != 'pull_request'
-        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
+        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
         with:
           cosign-release: 'v3.0.5'
 
@@ -164,7 +164,7 @@ jobs:
       # https://github.com/sigstore/cosign-installer
       - name: Install cosign
         if: github.event_name != 'pull_request'
-        uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4.1.0
+        uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
         with:
           cosign-release: 'v3.0.5'
 
diff --git a/.github/workflows/lint-workflows.yml b/.github/workflows/lint-workflows.yml
index ea9ef0b9..50b08ece 100644
--- a/.github/workflows/lint-workflows.yml
+++ b/.github/workflows/lint-workflows.yml
@@ -21,7 +21,7 @@ jobs:
             - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
             - name: Set up Python
-              uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
+              uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
               with:
                   python-version: '3.11'
 
@@ -36,7 +36,7 @@ jobs:
                     .github/actions/
 
             - name: Lint workflow logic (actionlint)
-              uses: rhysd/actionlint@03d0035246f3e81f36aed592ffb4bebf33a03106 # v1.7.7
+              uses: rhysd/actionlint@393031adb9afb225ee52ae2ccd7a5af5525e03e8 # v1.7.11
               with:
                   args: >-
                       -ignore SC2086
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8ef684c5..fe87fa5c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -28,7 +28,7 @@ jobs:
             - uses: actions/checkout@v6.0.2
 
             - name: Setup Deno
-              uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2
+              uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2
               with:
                   deno-version: ${{ env.DENO_VERSION }}
 
@@ -93,7 +93,7 @@ jobs:
             - uses: actions/checkout@v6.0.2
 
             - name: Setup Deno
-              uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2
+              uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2
               with:
                   deno-version: ${{ env.DENO_VERSION }}
 
diff --git a/.github/workflows/sentry-worker.yml b/.github/workflows/sentry-worker.yml
index 5cd9ab9b..b60cf307 100644
--- a/.github/workflows/sentry-worker.yml
+++ b/.github/workflows/sentry-worker.yml
@@ -23,7 +23,7 @@ jobs:
             - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
             - name: Setup Deno
-              uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2
+              uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2
               with:
                   deno-version: v2.x
 
diff --git a/.github/workflows/version-bump.yml b/.github/workflows/version-bump.yml
index d30ee0e5..d9a02fa7 100644
--- a/.github/workflows/version-bump.yml
+++ b/.github/workflows/version-bump.yml
@@ -52,7 +52,7 @@ jobs:
                   token: ${{ secrets.GITHUB_TOKEN }}
 
             - name: Setup Deno
-              uses: denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2
+              uses: denoland/setup-deno@667a34cdef165d8d2b2e98dde39547c9daac7282 # v2
               with:
                   deno-version: '2.x'