diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 3579902..afbf479 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -28,11 +28,11 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+      - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           languages: ${{ inputs.languages }}
           build-mode: none
-      - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+      - uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           # Queue refs can disappear after another group merges. Query execution
           # still gates the queue; stable PR and default-branch scans publish SARIF.
diff --git a/.github/workflows/nur.yml b/.github/workflows/nur.yml
index 3e2380b..0db9e82 100644
--- a/.github/workflows/nur.yml
+++ b/.github/workflows/nur.yml
@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: cachix/install-nix-action@13d8dd58da0234aa297dedd986986ccb8e7f3e24 # v31.11.1
+      - uses: cachix/install-nix-action@448cde739abec1eaf0646249e3d25bb8d9bc7702 # v31.11.2
       - name: Evaluate NUR entry point
         env:
           NIXPKGS_SOURCE: ${{ matrix.nixpkgs }}
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index b6ab1a1..970840e 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -37,6 +37,6 @@ jobs:
           path: results.sarif
           retention-days: 5
       - name: Upload SARIF to code scanning
-        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           sarif_file: results.sarif
diff --git a/actions/setup-nix/action.yml b/actions/setup-nix/action.yml
index 003b902..5cd9837 100644
--- a/actions/setup-nix/action.yml
+++ b/actions/setup-nix/action.yml
@@ -14,7 +14,7 @@ outputs:
 runs:
   using: composite
   steps:
-    - uses: DeterminateSystems/determinate-nix-action@d0c908e6cbe9f89f36ed8205a3ab6f092636916a # v3.23.1
+    - uses: DeterminateSystems/determinate-nix-action@e847f25223456b3058e12f7fc9d777b6a6f25060 # v3.23.2
     - name: Restore Nix store
       id: cache
       if: inputs.cache == 'true'