diff --git a/.github/workflows/dast.yml b/.github/workflows/dast.yml
index b5f5c24..0b58464 100644
--- a/.github/workflows/dast.yml
+++ b/.github/workflows/dast.yml
@@ -104,7 +104,7 @@ jobs:
 
       - name: Upload ZAP SARIF
         if: always() && hashFiles('zap-report.sarif') != ''
-        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v3
+        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd  # v3
         with:
           sarif_file: zap-report.sarif
           category: owasp-zap
diff --git a/.github/workflows/node-sast.yml b/.github/workflows/node-sast.yml
index 6047ca4..301cf93 100644
--- a/.github/workflows/node-sast.yml
+++ b/.github/workflows/node-sast.yml
@@ -88,7 +88,7 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4
+        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd  # v4
         with:
           # `actions` analyzes the workflow YAML itself (e.g. script-injection
           # via untrusted inputs) -- distinct from source analysis, and from
@@ -99,7 +99,7 @@ jobs:
           queries: security-extended
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4
+        uses: github/codeql-action/autobuild@1c5b675653bb5c22dbe9b12b556ec555138e09fd  # v4
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4
+        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd  # v4
diff --git a/.github/workflows/rust-sast.yml b/.github/workflows/rust-sast.yml
index 0fb9a39..d3d161e 100644
--- a/.github/workflows/rust-sast.yml
+++ b/.github/workflows/rust-sast.yml
@@ -90,7 +90,7 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4
+        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd  # v4
         with:
           # `actions` analyzes the workflow YAML itself (e.g. script-injection
           # via untrusted inputs) -- distinct from source analysis, and from
@@ -101,7 +101,7 @@ jobs:
           queries: security-extended
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4
+        uses: github/codeql-action/autobuild@1c5b675653bb5c22dbe9b12b556ec555138e09fd  # v4
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v4
+        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd  # v4
diff --git a/.github/workflows/sast.yml b/.github/workflows/sast.yml
index 2d6a094..2488633 100644
--- a/.github/workflows/sast.yml
+++ b/.github/workflows/sast.yml
@@ -87,7 +87,7 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v3
+        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd  # v3
         with:
           # `actions` analyzes the workflow YAML itself (e.g. script-injection
           # via untrusted inputs) -- distinct from python source analysis, and
@@ -98,7 +98,7 @@ jobs:
           queries: security-extended
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v3
+        uses: github/codeql-action/autobuild@1c5b675653bb5c22dbe9b12b556ec555138e09fd  # v3
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v3
+        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd  # v3
diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
index 87bc738..92ecbee 100644
--- a/.github/workflows/trivy.yml
+++ b/.github/workflows/trivy.yml
@@ -71,7 +71,7 @@ jobs:
 
       - name: Upload Trivy SARIF
         if: always() && hashFiles('trivy-results.sarif') != ''
-        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63  # v3
+        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd  # v3
         with:
           sarif_file: trivy-results.sarif
           category: trivy-fs