diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index a2c9318..4fb2e86 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -28,7 +28,7 @@ jobs:
         go-version-file: 'go.mod'
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
+      uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066 # v4
       with:
         languages: go
         queries: security-extended
@@ -37,6 +37,6 @@ jobs:
       run: go build -buildvcs=false ./...
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
+      uses: github/codeql-action/analyze@33d7b85da1a04171e211befe2c739303b9a4c066 # v4
       with:
         category: "/language:go"
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index 4ed6abf..393d9bd 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -196,7 +196,7 @@ jobs:
       uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
 
     - name: GoReleaser snapshot
-      uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+      uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
       with:
         version: "~> v2"
         args: release --snapshot --clean --skip=sign
@@ -257,7 +257,7 @@ jobs:
       uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
 
     - name: Install cosign (keyless signing)
-      uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+      uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3
 
     # CITATION.cff must name the release being cut (#102); checked before
     # anything is built or published.
@@ -276,7 +276,7 @@ jobs:
       run: .github/scripts/release-notes.sh "${GITHUB_REF_NAME}" > "${RUNNER_TEMP}/notes.md"
 
     - name: GoReleaser
-      uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+      uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
       with:
         version: "~> v2"
         args: release --clean --release-notes=${{ runner.temp }}/notes.md
@@ -334,7 +334,7 @@ jobs:
       uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
 
     - name: Log in to GHCR
-      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
+      uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4
       with:
         registry: ghcr.io
         username: ${{ github.actor }}
diff --git a/action.yml b/action.yml
index 3ddc36c..8a3b5f6 100644
--- a/action.yml
+++ b/action.yml
@@ -201,7 +201,7 @@ runs:
 
     - name: Save the baseline
       if: steps.scan.outputs.upload == 'true'
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
         name: ${{ inputs.baseline-artifact }}
         path: ${{ runner.temp }}/subenum-out/results.jsonl