diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 5e524f98..9bcae438 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -51,7 +51,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+      uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
       with:
         languages: go
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -62,7 +62,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+      uses: github/codeql-action/autobuild@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -76,4 +76,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+      uses: github/codeql-action/analyze@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
diff --git a/.github/workflows/dummy_c-ci.yaml b/.github/workflows/dummy_c-ci.yaml
index a258354c..14fdf8a1 100644
--- a/.github/workflows/dummy_c-ci.yaml
+++ b/.github/workflows/dummy_c-ci.yaml
@@ -31,7 +31,7 @@ jobs:
           sudo apt install -y --no-install-recommends build-essential
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+        uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
         with:
           languages: cpp
 
@@ -41,7 +41,7 @@ jobs:
           make libdummy_c.so
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+        uses: github/codeql-action/analyze@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
 
   formatting-check:
     runs-on: ubuntu-22.04
diff --git a/.github/workflows/k8smeta-ci.yaml b/.github/workflows/k8smeta-ci.yaml
index aa64e07f..e4b16ec4 100644
--- a/.github/workflows/k8smeta-ci.yaml
+++ b/.github/workflows/k8smeta-ci.yaml
@@ -37,7 +37,7 @@ jobs:
           sudo apt install -y --no-install-recommends cmake build-essential autoconf libtool pkg-config
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+        uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
         with:
           languages: cpp
 
@@ -49,7 +49,7 @@ jobs:
           make k8smeta -j6
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+        uses: github/codeql-action/analyze@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
 
       - name: Build and run tests 🏎️
         run: |
diff --git a/.github/workflows/reusable-publish-oci-artifacts.yaml b/.github/workflows/reusable-publish-oci-artifacts.yaml
index 1f357dee..c52297be 100644
--- a/.github/workflows/reusable-publish-oci-artifacts.yaml
+++ b/.github/workflows/reusable-publish-oci-artifacts.yaml
@@ -83,14 +83,14 @@ jobs:
 
     steps:
       - name: Log into ghcr.io
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4.8.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install Cosign v2
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3
         with:
           cosign-release: v2.6.2
 
@@ -100,7 +100,7 @@ jobs:
           cosign sign --yes ${{ matrix.value.repository.ref }}@${{ matrix.value.artifact.digest }}
 
       - name: Install Cosign v3
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3
 
       - name: Sign the artifacts with GitHub OIDC Token (OCI 1.1 referrers)
         run: |
diff --git a/.github/workflows/reusable_build_packages.yaml b/.github/workflows/reusable_build_packages.yaml
index 11d7872c..721413a8 100644
--- a/.github/workflows/reusable_build_packages.yaml
+++ b/.github/workflows/reusable_build_packages.yaml
@@ -74,7 +74,7 @@ jobs:
           cargo install bpf-linker@0.9.14
 
       - name: Configure Rust cache
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 #v2
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 #v2
 
       - name: Run build 🏗️
         run: ${{ inputs.makecommand }}
diff --git a/.github/workflows/update-changelogs.yaml b/.github/workflows/update-changelogs.yaml
index d31df7f2..a43df1b5 100644
--- a/.github/workflows/update-changelogs.yaml
+++ b/.github/workflows/update-changelogs.yaml
@@ -87,7 +87,7 @@ jobs:
 
       - name: Open PR
         if: steps.update.outputs.has_changes == 'true'
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        uses: peter-evans/create-pull-request@15733dbdfeedb4f7fdb73d13c6f5ac83b710fab8 # v8.1.2
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           base: main