diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 30a3c77..287b20b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -128,7 +128,7 @@ jobs:
         with:
           sarif: "tt-gate.sarif"
       - name: Publish findings as code-scanning annotations
-        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           sarif_file: tt-gate.sarif
 
@@ -151,7 +151,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           node-version: "22"
           package-manager-cache: false
diff --git a/.github/workflows/plugin-scan.yml b/.github/workflows/plugin-scan.yml
index 761bab0..cf0dc5f 100644
--- a/.github/workflows/plugin-scan.yml
+++ b/.github/workflows/plugin-scan.yml
@@ -18,7 +18,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Scan plugin with HOL Guard
-        uses: hashgraph-online/ai-plugin-scanner-action@a4705d710505d3e8f6d639b683a0c87dd31ce598 # v1.2.748
+        uses: hashgraph-online/ai-plugin-scanner-action@390cfe83a5a99b0a8d97d93b438cb99f23ce177e # v1.2.783
         with:
           plugin_dir: "."
           fail_on_severity: high