diff --git a/.github/workflows/claude-pr-checks.yml b/.github/workflows/claude-pr-checks.yml
index 46e127a4..1b2593f8 100644
--- a/.github/workflows/claude-pr-checks.yml
+++ b/.github/workflows/claude-pr-checks.yml
@@ -84,7 +84,7 @@ jobs:
         # finishes without calling the structured-output tool, and a review
         # with zero findings reliably ends exactly that way.
         continue-on-error: true
-        uses: anthropics/claude-code-action@be7b93b1907a4abad570368f3c74b6fe3807510b # v1.0.183
+        uses: anthropics/claude-code-action@833fb0f8c9f6686b33d963a8bae0a94f4936ab2a # v1.0.211
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           # Without this the action exchanges an OIDC token for a GitHub App
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index be38f903..c1c0ceaf 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -32,7 +32,7 @@ jobs:
           go-version: '1.26.4'
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           languages: go
           # Without this, the CodeQL bundle version is resolved from
@@ -42,7 +42,7 @@ jobs:
           tools: linked
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
diff --git a/.github/workflows/plumber-action.yml b/.github/workflows/plumber-action.yml
index 277311f7..99d15279 100644
--- a/.github/workflows/plumber-action.yml
+++ b/.github/workflows/plumber-action.yml
@@ -63,7 +63,7 @@ jobs:
 
       - name: Upload SARIF to Code Scanning
         if: ${{ always() && hashFiles('plumber.sarif') != '' }}
-        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: plumber.sarif
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index add030a9..738b71b9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -161,7 +161,7 @@ jobs:
 
       - name: Attest build provenance
         id: attest
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: dist/plumber-*
 
@@ -214,7 +214,7 @@ jobs:
           image: docker.io/tonistiigi/binfmt:qemu-v10.2.3@sha256:400a4873b838d1b89194d982c45e5fb3cda4593fbfd7e08a02e76b03b21166f0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
         with:
           # The docker-container driver otherwise boots the mutable
           # moby/buildkit:buildx-stable-1 tag; pin it by digest.
@@ -267,7 +267,7 @@ jobs:
           no-cache-filters: runtime
 
       - name: Attest Docker image
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-name: docker.io/getplumber/plumber
           subject-digest: ${{ steps.push.outputs.digest }}
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 6ce0b1e1..8375b632 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -40,7 +40,7 @@ jobs:
           publish_results: true
 
       - name: Upload SARIF
-        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: results.sarif
 
diff --git a/action.yml b/action.yml
index 3ae49d97..fbc061a1 100644
--- a/action.yml
+++ b/action.yml
@@ -278,7 +278,7 @@ runs:
 
     - name: Upload SARIF to Code Scanning
       if: ${{ always() && inputs.upload-sarif == 'true' && inputs.sarif != '' && hashFiles(inputs.sarif) != '' }}
-      uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+      uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
       with:
         sarif_file: ${{ inputs.sarif }}