diff --git a/.github/workflows/ci-run.yml b/.github/workflows/ci-run.yml
index 229f747..21d0d64 100644
--- a/.github/workflows/ci-run.yml
+++ b/.github/workflows/ci-run.yml
@@ -212,7 +212,7 @@ jobs:
 
             - name: Link check (offline, added links only)
               if: steps.collect_links.outputs.count != '0'
-              uses: lycheeverse/lychee-action@a8c4c7cb88f0c7386610c35eb25108e448569cb0 # v2
+              uses: lycheeverse/lychee-action@8646ba30535128ac92d33dfc9133794bfdd9b411 # v2
               with:
                   fail: true
                   args: >-
diff --git a/.github/workflows/sec-audit.yml b/.github/workflows/sec-audit.yml
index 271a0bf..2ce1ea1 100644
--- a/.github/workflows/sec-audit.yml
+++ b/.github/workflows/sec-audit.yml
@@ -328,7 +328,7 @@ jobs:
 
             - name: Upload gitleaks SARIF
               if: always()
-              uses: github/codeql-action/upload-sarif@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4
+              uses: github/codeql-action/upload-sarif@c793b717bc78562f491db7b0e93a3a178b099162 # v4
               with:
                   sarif_file: artifacts/gitleaks.sarif
                   category: gitleaks
diff --git a/.github/workflows/sec-codeql.yml b/.github/workflows/sec-codeql.yml
index a2bc484..50455d0 100644
--- a/.github/workflows/sec-codeql.yml
+++ b/.github/workflows/sec-codeql.yml
@@ -52,7 +52,7 @@ jobs:
                   fetch-depth: 0
 
             - name: Initialize CodeQL
-              uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4
+              uses: github/codeql-action/init@c793b717bc78562f491db7b0e93a3a178b099162 # v4
               with:
                   languages: rust
                   config-file: ./.github/codeql/codeql-config.yml
@@ -67,6 +67,6 @@ jobs:
               run: cargo build --workspace --all-targets --locked
 
             - name: Perform CodeQL Analysis
-              uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4
+              uses: github/codeql-action/analyze@c793b717bc78562f491db7b0e93a3a178b099162 # v4
               with:
                   category: "/language:rust"