diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 6122cf2..2b54270 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -32,7 +32,7 @@ jobs:
           fetch-depth: 0 # avoid shallow clone so nbgv can do its work.
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           languages: csharp
 
@@ -49,7 +49,7 @@ jobs:
         run: dotnet build --configuration Release ./src/GenerateNotice.Nuget/nuget.proj
 
       - name: Upload GenerateNotice package
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: GenerateNotice-package
           path: ./src/GenerateNotice.Nuget/*.nupkg
@@ -59,7 +59,7 @@ jobs:
         run: dotnet pack --configuration Release
 
       - name: Upload Packages
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: bicep-nupkg-any
           path: out/*
@@ -74,4 +74,4 @@ jobs:
           flags: dotnet
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
\ No newline at end of file
+        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
\ No newline at end of file