diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2de907f..2a21ede 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -85,7 +85,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       # make codeguard-ci: CI intentionally runs the stable Marketplace action instead of the in-repo binary.
-      - uses: devr-tools/codeguard@8d9ea157e0de725dfa74ee954be9f4ef6157d9f1
+      - uses: devr-tools/codeguard@05b9c78421bb7cd13a953f5441a6cd8f7a58815f
         with:
           config: .codeguard/codeguard.yaml
 
diff --git a/.github/workflows/homebrew-validation.yml b/.github/workflows/homebrew-validation.yml
index c3bac26..eba0239 100644
--- a/.github/workflows/homebrew-validation.yml
+++ b/.github/workflows/homebrew-validation.yml
@@ -25,7 +25,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Homebrew
-        uses: Homebrew/actions/setup-homebrew@8f3d1ec8a696b3b9d9a6c3696b6c73033cab69e4 # main
+        uses: Homebrew/actions/setup-homebrew@848c272c7bfe984a197bd4d16383f4c106ec61e6 # main
 
       - name: Clone Homebrew tap
         shell: bash
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6ff4d43..401081b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -169,10 +169,10 @@ jobs:
           go-version-file: go.mod
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4
 
       - name: Install cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
@@ -185,7 +185,7 @@ jobs:
           cosign-release: v2.6.3
 
       - name: Install syft (SBOM generation)
-        uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0
+        uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
 
       - name: Log in to GHCR
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4