diff --git a/.github/workflows/check-actions.yaml b/.github/workflows/check-actions.yaml
index 6e1cf7a6..ffb62c1c 100644
--- a/.github/workflows/check-actions.yaml
+++ b/.github/workflows/check-actions.yaml
@@ -18,7 +18,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Ensure SHA pinned actions
-        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@c4e71056006d29f90204b2d063be337109507d62 # v5.0.10
+        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@76ed8a4c86957c2d27d44bab47f172193149d926 # v5.0.11
         with:
           # slsa-github-generator requires using a semver tag for reusable workflows.
           # See: https://github.com/slsa-framework/slsa-github-generator#referencing-slsa-builders-and-generators
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 94311b93..493484fd 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -35,7 +35,7 @@ jobs:
           persist-credentials: false
       - uses: ./.github/actions/setup
       - name: Run Gosec Security Scanner
-        uses: securego/gosec@deb54465fea23d19a77f037e11e6589021f8501d # v2.29.0
+        uses: securego/gosec@5eb1d104ef85ff2c905c877eb600e8c1dee33a22 # v2.30.0
         with:
           args: '-no-fail -fmt sarif -out gosec.sarif ./...'
       - name: Upload SARIF file
diff --git a/.github/workflows/gosec.yaml b/.github/workflows/gosec.yaml
index 3f4d55b5..46ce7837 100644
--- a/.github/workflows/gosec.yaml
+++ b/.github/workflows/gosec.yaml
@@ -27,7 +27,7 @@ jobs:
         with:
           go-version-file: 'go.mod'
       - name: Run Gosec Security Scanner
-        uses: securego/gosec@deb54465fea23d19a77f037e11e6589021f8501d # v2.29.0
+        uses: securego/gosec@5eb1d104ef85ff2c905c877eb600e8c1dee33a22 # v2.30.0
         with:
           args: '-no-fail -fmt sarif -out gosec.sarif ./...'
       - name: Upload SARIF file
diff --git a/.github/workflows/osps.yml b/.github/workflows/osps.yml
index 8f1c8d21..81aea5ea 100644
--- a/.github/workflows/osps.yml
+++ b/.github/workflows/osps.yml
@@ -38,7 +38,7 @@ jobs:
           fi
       - name: OSPS Baseline scan
         id: scan
-        uses: revanite-io/osps-baseline-action@1af7ff8b44af83f120b20cc5f63b877286849257 # v1.5.2
+        uses: revanite-io/osps-baseline-action@8417b9d0c0e789c3fe4e93996e47a3a8aafe6965 # v1.5.4
         with:
           owner: ${{ github.repository_owner }}
           repo: ${{ github.event.repository.name }}
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index f4caa752..a91cb9bc 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -37,6 +37,6 @@ jobs:
           path: results.sarif
           retention-days: 5
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           sarif_file: results.sarif
diff --git a/e2e/manifests/distro/openbao.flux.yaml b/e2e/manifests/distro/openbao.flux.yaml
index e0aba236..d6b613e2 100644
--- a/e2e/manifests/distro/openbao.flux.yaml
+++ b/e2e/manifests/distro/openbao.flux.yaml
@@ -22,7 +22,7 @@ spec:
   chart:
     spec:
       chart: openbao
-      version: "0.30.4"
+      version: "0.30.6"
       sourceRef:
         kind: HelmRepository
         name: openbao