diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 11ddc61f..8d4d1865 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -35,12 +35,12 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           languages: ${{ matrix.language }}
           build-mode: none
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/loader-integration.yml b/.github/workflows/loader-integration.yml
index 6069b762..5e7fd33e 100644
--- a/.github/workflows/loader-integration.yml
+++ b/.github/workflows/loader-integration.yml
@@ -137,7 +137,7 @@ jobs:
     # HTTP(S)_PROXY settings and the upload fails with ECONNRESET. v7.0.1
     # reworked the upload path and uploads successfully through the proxy, so
     # every artifact upload in this job is pinned to v7.0.1.
-    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+    - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       if: steps.include-diff.outputs.diff == '1'
       id: upload-diff-artifact
       with:
@@ -180,7 +180,7 @@ jobs:
         diff_comment = f"```diff\n{diff_content}\n```"
         with open('rst_results_comment.txt', 'w') as results_file:
             results_file.write(diff_comment)
-    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+    - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       if: steps.rst-diff.outputs.diff == '1'
       id: upload-rst-diff-artifact
       with:
@@ -223,7 +223,7 @@ jobs:
         diff_comment = f"```diff\n{diff_content}\n```"
         with open('html_results_comment.txt', 'w') as results_file:
             results_file.write(diff_comment)
-    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+    - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       if: steps.html-diff.outputs.diff == '1'
       id: upload-html-diff-artifact
       with:
@@ -247,7 +247,7 @@ jobs:
             });
     - name: Upload HTML documentation artifacts for preview
       if: steps.html-diff.outputs.diff == '1'
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       id: upload-html-docs
       with:
         name: html-documentation-preview
@@ -373,7 +373,7 @@ jobs:
         loader_diff_comment = f"```diff\n{loader_diff_content}\n```"
         with open('loader_results_comment.txt', 'w') as results_file:
             results_file.write(loader_diff_comment)
-    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+    - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       if: steps.loader-source-diff.outputs.diff == '1'
       id: upload-loader-diff-artifact
       with:
@@ -582,7 +582,7 @@ jobs:
             console.log('No reviewer approval found for ABI failure');
             core.setOutput('approved', 'false');
           }
-    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+    - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       id: abi-report-artifact
       continue-on-error: true
       with:
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 4c9d8452..6f34ff3f 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -41,7 +41,7 @@ jobs:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+        uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0
         with:
           results_file: results.sarif
           results_format: sarif
@@ -63,7 +63,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: SARIF file
           path: results.sarif
@@ -71,6 +71,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           sarif_file: results.sarif