diff --git a/.github/workflows/_ci-check.yml b/.github/workflows/_ci-check.yml
index b0f7861..a359d58 100644
--- a/.github/workflows/_ci-check.yml
+++ b/.github/workflows/_ci-check.yml
@@ -179,7 +179,7 @@ jobs:
       # for installed here, Gradle resolves it locally and provisions nothing.
       - name: Set up Java
         if: inputs.setup-java
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: ${{ inputs.java-distribution }}
           java-version: ${{ inputs.java-version }}
diff --git a/.github/workflows/_ci-e2e.yml b/.github/workflows/_ci-e2e.yml
index 6c620ad..c0032e0 100644
--- a/.github/workflows/_ci-e2e.yml
+++ b/.github/workflows/_ci-e2e.yml
@@ -121,7 +121,7 @@ jobs:
       # same pull request; toolchains are not cached.
       - name: Set up Java
         if: inputs.setup-java
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: ${{ inputs.java-distribution }}
           java-version: ${{ inputs.java-version }}
diff --git a/.github/workflows/_ci-gradle.yml b/.github/workflows/_ci-gradle.yml
index 58ab036..a986fa5 100644
--- a/.github/workflows/_ci-gradle.yml
+++ b/.github/workflows/_ci-gradle.yml
@@ -67,11 +67,11 @@ jobs:
         with:
           node-version: ${{ inputs.node-version }}
           cache: pnpm
-      - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+      - uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: temurin
           java-version: ${{ inputs.java-version }}
-      - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
+      - uses: gradle/actions/setup-gradle@8da46b539cd8fe6ab27ca75128919a18d757604c # v6.4.1
         with:
           # Trusted branch runs populate caches for PRs against that branch; fork PRs only read.
           cache-read-only: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }}
diff --git a/.github/workflows/_ci-lighthouse.yml b/.github/workflows/_ci-lighthouse.yml
index 6fede11..c19d23b 100644
--- a/.github/workflows/_ci-lighthouse.yml
+++ b/.github/workflows/_ci-lighthouse.yml
@@ -224,7 +224,7 @@ jobs:
       # same pull request; toolchains are not cached.
       - name: Set up Java
         if: inputs.setup-java
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: ${{ inputs.java-distribution }}
           java-version: ${{ inputs.java-version }}
diff --git a/.github/workflows/_codeql.yml b/.github/workflows/_codeql.yml
index 9bbb7bf..4dde347 100644
--- a/.github/workflows/_codeql.yml
+++ b/.github/workflows/_codeql.yml
@@ -76,14 +76,14 @@ jobs:
           cache: true
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.language == 'go' && 'autobuild' || 'none' }}
           queries: security-extended,security-and-quality
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           category: '/language:${{ matrix.language }}'
 
diff --git a/.github/workflows/_coverage.yml b/.github/workflows/_coverage.yml
index 4a25dec..94b5548 100644
--- a/.github/workflows/_coverage.yml
+++ b/.github/workflows/_coverage.yml
@@ -61,7 +61,7 @@ jobs:
         with:
           name: ${{ inputs.artifact }}
 
-      - uses: kirchDev/coverage-report@f2e83d922e6406b97437c2f90c68eae941656f22 # v0.3.0
+      - uses: kirchDev/coverage-report@445c5909244f6a9b7154087eb416e9b20d555d46 # v0.4.0
         with:
           reports: ${{ inputs.reports }}
           min-patch: ${{ inputs.min-patch }}
diff --git a/.github/workflows/_fast-forward-queue.yml b/.github/workflows/_fast-forward-queue.yml
index 70ada3c..606eff0 100644
--- a/.github/workflows/_fast-forward-queue.yml
+++ b/.github/workflows/_fast-forward-queue.yml
@@ -227,7 +227,7 @@ jobs:
       - name: Mint Queue App token
         id: app-token
         if: steps.existing.outputs.create == 'true'
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           client-id: ${{ needs.resolve.outputs.app-client-id }}
           private-key: ${{ needs.resolve.outputs.app-key-source == 'secret' && secrets.QUEUE_APP_PRIVATE_KEY || env.QUEUE_APP_PEM }}
@@ -477,7 +477,7 @@ jobs:
 
       - name: Mint Queue App token
         id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           client-id: ${{ needs.resolve.outputs.app-client-id }}
           private-key: ${{ needs.resolve.outputs.app-key-source == 'secret' && secrets.QUEUE_APP_PRIVATE_KEY || env.QUEUE_APP_PEM }}
diff --git a/.github/workflows/_open-regenerated-pr.yml b/.github/workflows/_open-regenerated-pr.yml
index 2f26553..d1ce47f 100644
--- a/.github/workflows/_open-regenerated-pr.yml
+++ b/.github/workflows/_open-regenerated-pr.yml
@@ -287,7 +287,7 @@ jobs:
       - name: Mint the App token
         id: app-token
         if: steps.diff.outputs.changed == 'true' || steps.diff-custom.outputs.changed == 'true'
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           client-id: ${{ steps.app.outputs.client-id }}
           private-key: ${{ steps.app.outputs.key-source == 'secret' && secrets.RELEASE_APP_PRIVATE_KEY || env.RELEASE_APP_PEM }}
diff --git a/.github/workflows/_publish-goreleaser.yml b/.github/workflows/_publish-goreleaser.yml
index c89851a..324d1b6 100644
--- a/.github/workflows/_publish-goreleaser.yml
+++ b/.github/workflows/_publish-goreleaser.yml
@@ -90,7 +90,7 @@ jobs:
           passphrase: ${{ env.GPG_PASSPHRASE }}
 
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
         with:
           version: '~> v2'
           args: release --clean
diff --git a/.github/workflows/_queue-branch.yml b/.github/workflows/_queue-branch.yml
index cf1a93e..f742576 100644
--- a/.github/workflows/_queue-branch.yml
+++ b/.github/workflows/_queue-branch.yml
@@ -193,7 +193,7 @@ jobs:
       - name: Mint Queue App token
         id: app-token
         if: steps.existing.outputs.create == 'true'
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           client-id: ${{ steps.app.outputs.client-id }}
           private-key: ${{ steps.app.outputs.key-source == 'secret' && secrets.QUEUE_APP_PRIVATE_KEY || env.QUEUE_APP_PEM }}
diff --git a/.github/workflows/_release-please.yml b/.github/workflows/_release-please.yml
index 58b2dea..ad92ffe 100644
--- a/.github/workflows/_release-please.yml
+++ b/.github/workflows/_release-please.yml
@@ -151,7 +151,7 @@ jobs:
 
       - name: Mint Release App token
         id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           client-id: ${{ steps.app.outputs.client-id }}
           private-key: ${{ steps.app.outputs.key-source == 'secret' && secrets.RELEASE_APP_PRIVATE_KEY || env.RELEASE_APP_PEM }}