diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2de907f..db462da 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -85,7 +85,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       # make codeguard-ci: CI intentionally runs the stable Marketplace action instead of the in-repo binary.
-      - uses: devr-tools/codeguard@8d9ea157e0de725dfa74ee954be9f4ef6157d9f1
+      - uses: devr-tools/codeguard@5d11767a99393c1d6f1959b0ab8ec293761252a5
         with:
           config: .codeguard/codeguard.yaml
 
diff --git a/.github/workflows/homebrew-validation.yml b/.github/workflows/homebrew-validation.yml
index c3bac26..845ad24 100644
--- a/.github/workflows/homebrew-validation.yml
+++ b/.github/workflows/homebrew-validation.yml
@@ -25,7 +25,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Homebrew
-        uses: Homebrew/actions/setup-homebrew@8f3d1ec8a696b3b9d9a6c3696b6c73033cab69e4 # main
+        uses: Homebrew/actions/setup-homebrew@3cdb78d0f62ad29dd32de765782654f4eedea607 # main
 
       - name: Clone Homebrew tap
         shell: bash
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6ff4d43..a3218cc 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -185,7 +185,7 @@ jobs:
           cosign-release: v2.6.3
 
       - name: Install syft (SBOM generation)
-        uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0
+        uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
 
       - name: Log in to GHCR
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4