diff --git a/.github/workflows/release-please.yaml b/.github/workflows/release-please.yaml
index a579df07..b6a104bc 100644
--- a/.github/workflows/release-please.yaml
+++ b/.github/workflows/release-please.yaml
@@ -39,7 +39,7 @@ jobs:
     steps:
       - name: Generate a token
         id: generate-token
-        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
+        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
         with:
           app-id: ${{ secrets.TERO_BOT_CLIENT_ID }}
           private-key: ${{ secrets.TERO_BOT_PRIVATE_SIGNING_KEY }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 1b7c27a7..85af6230 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -54,7 +54,7 @@ jobs:
         with:
           ref: ${{ env.TAG_NAME }}
 
-      - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
+      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
         with:
           go-version-file: go.mod
           cache: true
@@ -180,7 +180,7 @@ jobs:
 
       - name: Generate a token
         id: generate-token
-        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2
+        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2
         with:
           app-id: ${{ secrets.TERO_BOT_CLIENT_ID }}
           private-key: ${{ secrets.TERO_BOT_PRIVATE_SIGNING_KEY }}
diff --git a/.github/workflows/security.yaml b/.github/workflows/security.yaml
index d1db722a..f29797e7 100644
--- a/.github/workflows/security.yaml
+++ b/.github/workflows/security.yaml
@@ -20,7 +20,7 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
-      - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6
+      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
         with:
           go-version-file: go.mod
           cache: true
diff --git a/.github/workflows/workflow-lint.yaml b/.github/workflows/workflow-lint.yaml
index a9b3ae8b..c5af3baf 100644
--- a/.github/workflows/workflow-lint.yaml
+++ b/.github/workflows/workflow-lint.yaml
@@ -20,6 +20,6 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Run actionlint
-        uses: reviewdog/action-actionlint@f45e6423f07e6ea6fce879bbdb0d74407c1fbf55 # v1
+        uses: reviewdog/action-actionlint@0d952c597ef8459f634d7145b0b044a9699e5e43 # v1
         with:
           fail_level: any