diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bf999953..315d557a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -30,7 +30,7 @@ jobs:
       # container) so keyless OIDC signing can use the runner's identity
       # token directly — no need to plumb ACTIONS_ID_TOKEN_REQUEST_* vars
       # through `docker run`.
-      - uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1
+      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         with:
           cosign-release: v2.4.1
 
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 51dfaa8e..63541aef 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -59,6 +59,6 @@ jobs:
 
       # SARIF into the Security tab so findings show up per-PR.
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4
+        uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 11c6f3e7..019f2d0f 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -43,6 +43,6 @@ jobs:
           format: sarif
           output: trivy-fs.sarif
       - if: always()
-        uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4
+        uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4
         with:
           sarif_file: trivy-fs.sarif