diff --git a/.github/workflows/codeql-actions.yml b/.github/workflows/codeql-actions.yml
index dea0aee..90fe274 100644
--- a/.github/workflows/codeql-actions.yml
+++ b/.github/workflows/codeql-actions.yml
@@ -24,13 +24,13 @@ jobs:
           ref: ${{ github.event.pull_request.head.sha }}
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           languages: actions
           queries: security-extended,security-and-quality
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
         with:
           category: /language:actions
           # Fork PRs receive a read-only GITHUB_TOKEN, so SARIF upload to the
diff --git a/.github/workflows/e2e-checkpoints-v2.yml b/.github/workflows/e2e-checkpoints-v2.yml
index dfcfe73..3c60a36 100644
--- a/.github/workflows/e2e-checkpoints-v2.yml
+++ b/.github/workflows/e2e-checkpoints-v2.yml
@@ -49,7 +49,7 @@ jobs:
           echo 'somecredstorepass' | gnome-keyring-daemon --unlock
 
       - name: Setup mise
-        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
+        uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4
 
       - name: Build trace CLI
         run: go build -o /usr/local/bin/trace ./cmd/trace
@@ -136,7 +136,7 @@ jobs:
           echo 'somecredstorepass' | gnome-keyring-daemon --unlock
 
       - name: Setup mise
-        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
+        uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4
 
       - name: Build trace CLI
         run: go build -o /usr/local/bin/trace ./cmd/trace
diff --git a/.github/workflows/e2e-isolated.yml b/.github/workflows/e2e-isolated.yml
index 304f9ba..2900abd 100644
--- a/.github/workflows/e2e-isolated.yml
+++ b/.github/workflows/e2e-isolated.yml
@@ -24,7 +24,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup mise
-        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
+        uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4
 
       - name: Install system dependencies
         run: sudo apt-get update && sudo apt-get install -y tmux
diff --git a/.github/workflows/e2e-windows.yml b/.github/workflows/e2e-windows.yml
index 42688a8..2877eca 100644
--- a/.github/workflows/e2e-windows.yml
+++ b/.github/workflows/e2e-windows.yml
@@ -23,7 +23,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup mise
-        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
+        uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4
 
       - name: Install Claude Code
         run: |
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index c41abea..1fda8fe 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -61,7 +61,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup mise
-        uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
+        uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4
 
       - name: Install system dependencies
         run: sudo apt-get update && sudo apt-get install -y tmux
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 5d0e38f..83940b2 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -22,7 +22,7 @@ jobs:
         with:
           go-version-file: go.mod
 
-      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4
+      - uses: jdx/mise-action@dba19683ed58901619b14f395a24841710cb4925 # v4
 
       - name: Run linters
         run: mise run lint
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index b8ddebe..6cc8443 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -21,7 +21,7 @@ jobs:
       - name: Generate token
         id: app-token
         if: ${{ env.HOMEBREW_TAP_APP_ID != '' && env.HOMEBREW_TAP_APP_PRIVATE_KEY != '' }}
-        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           client-id: ${{ secrets.HOMEBREW_TAP_APP_ID }}
           private-key: ${{ secrets.HOMEBREW_TAP_APP_PRIVATE_KEY }}