diff --git a/.github/workflows/codecov.yml b/.github/workflows/codecov.yml
index 6ecd0b0f..2b7bcee9 100644
--- a/.github/workflows/codecov.yml
+++ b/.github/workflows/codecov.yml
@@ -105,7 +105,7 @@ jobs:
         run: exit 1
 
       - name: Upload test results to Codecov
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: junit.xml
@@ -113,7 +113,7 @@ jobs:
           verbose: true
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           slug: CaptorAB/openseries
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index f80edb7a..75e07650 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -53,7 +53,7 @@ jobs:
 
       - name: Initialize CodeQL
         if: ${{ steps.paths.outputs.run == 'true' }}
-        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
           languages: python
 
@@ -75,6 +75,6 @@ jobs:
 
       - name: Perform CodeQL analysis
         if: ${{ steps.paths.outputs.run == 'true' }}
-        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
           category: /language:python
diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml
index 5aad3d6a..77359f82 100644
--- a/.github/workflows/supply-chain.yml
+++ b/.github/workflows/supply-chain.yml
@@ -79,7 +79,7 @@ jobs:
 
       - name: Run OSV-Scanner
         if: ${{ steps.paths.outputs.run == 'true' }}
-        uses: google/osv-scanner-action/osv-scanner-action@6e4298ebc4db23e847df9b2e2de2939d6f066c67 # v2.5.1
+        uses: google/osv-scanner-action/osv-scanner-action@a345acffa64b0eaede81a3d9aae6141214d9c8fc # v2.6.0
         with:
           scan-args: --lockfile=uv.lock
 
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index c1d9cf8b..db926d3e 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -70,7 +70,7 @@ jobs:
 
       - name: Upload SARIF file
         if: ${{ always() && steps.paths.outputs.run == 'true' }}
-        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
           sarif_file: results.sarif
           category: zizmor