diff --git a/.github/workflows/apm-materialize.yml b/.github/workflows/apm-materialize.yml
index 6b54722..aa4ffde 100644
--- a/.github/workflows/apm-materialize.yml
+++ b/.github/workflows/apm-materialize.yml
@@ -42,7 +42,7 @@ jobs:
     steps:
       - name: Harden runner
         # renovate: datasource=github-tags depName=DevSecNinja/.github
-        uses: DevSecNinja/.github/actions/harden-runner@0d0f448de257f354c89dc3a128871235d6ba8c11 # v2.5.0
+        uses: DevSecNinja/.github/actions/harden-runner@24acc67adf1be33089e73b2fdbdb4be8c12d145b # v3.2.0
 
       - name: Generate App token
         id: app-token
@@ -104,7 +104,7 @@ jobs:
       - name: Open materialize PR
         if: steps.precheck.outputs.skip != 'true'
         # renovate: datasource=github-tags depName=DevSecNinja/.github
-        uses: DevSecNinja/.github/actions/open-pr@0d0f448de257f354c89dc3a128871235d6ba8c11 # v2.5.0
+        uses: DevSecNinja/.github/actions/open-pr@24acc67adf1be33089e73b2fdbdb4be8c12d145b # v3.2.0
         with:
           branch: chore/apm-materialize
           base: main
diff --git a/.github/workflows/apm-sync.yml b/.github/workflows/apm-sync.yml
index be4b8a4..be45eee 100644
--- a/.github/workflows/apm-sync.yml
+++ b/.github/workflows/apm-sync.yml
@@ -88,7 +88,7 @@ jobs:
     steps:
       - name: Harden runner
         # renovate: datasource=github-tags depName=DevSecNinja/.github
-        uses: DevSecNinja/.github/actions/harden-runner@0d0f448de257f354c89dc3a128871235d6ba8c11 # v2.5.0
+        uses: DevSecNinja/.github/actions/harden-runner@24acc67adf1be33089e73b2fdbdb4be8c12d145b # v3.2.0
 
       - name: Generate App token
         id: app-token
@@ -149,7 +149,7 @@ jobs:
         id: open-pr
         if: steps.precheck.outputs.skip != 'true'
         # renovate: datasource=github-tags depName=DevSecNinja/.github
-        uses: DevSecNinja/.github/actions/open-pr@0d0f448de257f354c89dc3a128871235d6ba8c11 # v2.5.0
+        uses: DevSecNinja/.github/actions/open-pr@24acc67adf1be33089e73b2fdbdb4be8c12d145b # v3.2.0
         with:
           branch: ${{ inputs.pr-branch }}
           base: ${{ inputs.target-branch }}
diff --git a/.github/workflows/config-sync.yml b/.github/workflows/config-sync.yml
index 91a9635..221a127 100644
--- a/.github/workflows/config-sync.yml
+++ b/.github/workflows/config-sync.yml
@@ -173,7 +173,7 @@ jobs:
           fi
       - name: Create PR if configs changed
         if: steps.pull.outputs.updated == '1'
-        uses: DevSecNinja/.github/actions/open-pr@0d0f448de257f354c89dc3a128871235d6ba8c11 # v2.5.0
+        uses: DevSecNinja/.github/actions/open-pr@24acc67adf1be33089e73b2fdbdb4be8c12d145b # v3.2.0
         with:
           branch: chore/config-sync
           title: 'chore: sync config files from central repo'
diff --git a/.github/workflows/release-please-caller.yml b/.github/workflows/release-please-caller.yml
index 195c0af..8f7711b 100644
--- a/.github/workflows/release-please-caller.yml
+++ b/.github/workflows/release-please-caller.yml
@@ -32,7 +32,7 @@ concurrency:
 jobs:
   release-please:
     # Self-reference pinned to the released fail-closed workflow.
-    uses: DevSecNinja/.github/.github/workflows/release-please.yml@c61e8107b080f72e25bfc41d3eef947dbfa66446 # v3.0.0
+    uses: DevSecNinja/.github/.github/workflows/release-please.yml@24acc67adf1be33089e73b2fdbdb4be8c12d145b # v3.2.0
     permissions:
       contents: write
       pull-requests: write
diff --git a/.github/workflows/vendored-file-sync.yml b/.github/workflows/vendored-file-sync.yml
index e831420..fcf3eba 100644
--- a/.github/workflows/vendored-file-sync.yml
+++ b/.github/workflows/vendored-file-sync.yml
@@ -149,7 +149,7 @@ jobs:
       - name: Open or update vendored-file sync PR
         id: open-pr
         if: ${{ inputs.create-pr && steps.detect.outputs.changed == 'true' }}
-        uses: DevSecNinja/.github/actions/open-pr@0d0f448de257f354c89dc3a128871235d6ba8c11 # v2.5.0
+        uses: DevSecNinja/.github/actions/open-pr@24acc67adf1be33089e73b2fdbdb4be8c12d145b # v3.2.0
         with:
           branch: ${{ inputs.branch }}
           base: ${{ inputs.base }}
diff --git a/workflow-templates/assign-issue-to-codeowners.yml b/workflow-templates/assign-issue-to-codeowners.yml
index 8f17eba..b95a34e 100644
--- a/workflow-templates/assign-issue-to-codeowners.yml
+++ b/workflow-templates/assign-issue-to-codeowners.yml
@@ -17,7 +17,7 @@ permissions:
 
 jobs:
   assign:
-    uses: DevSecNinja/.github/.github/workflows/assign-issue-to-codeowners.yml@0d0f448de257f354c89dc3a128871235d6ba8c11 # v2.5.0
+    uses: DevSecNinja/.github/.github/workflows/assign-issue-to-codeowners.yml@24acc67adf1be33089e73b2fdbdb4be8c12d145b # v3.2.0
     with:
       issue-number: ${{ inputs.issue-number || 0 }}
     permissions:
diff --git a/workflow-templates/config-sync.yml b/workflow-templates/config-sync.yml
index fc692ef..488d4de 100644
--- a/workflow-templates/config-sync.yml
+++ b/workflow-templates/config-sync.yml
@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   sync:
-    uses: DevSecNinja/.github/.github/workflows/config-sync.yml@0d0f448de257f354c89dc3a128871235d6ba8c11 # v2.5.0
+    uses: DevSecNinja/.github/.github/workflows/config-sync.yml@24acc67adf1be33089e73b2fdbdb4be8c12d145b # v3.2.0
     permissions:
       contents: write
       pull-requests: write
diff --git a/workflow-templates/label-sync.yml b/workflow-templates/label-sync.yml
index 5db659f..8f0f06f 100644
--- a/workflow-templates/label-sync.yml
+++ b/workflow-templates/label-sync.yml
@@ -17,7 +17,7 @@ permissions:
 
 jobs:
   label-sync:
-    uses: DevSecNinja/.github/.github/workflows/label-sync.yml@0d0f448de257f354c89dc3a128871235d6ba8c11 # v2.5.0
+    uses: DevSecNinja/.github/.github/workflows/label-sync.yml@24acc67adf1be33089e73b2fdbdb4be8c12d145b # v3.2.0
     permissions:
       contents: read
       issues: write
diff --git a/workflow-templates/labeler.yml b/workflow-templates/labeler.yml
index 87a3381..2c693e2 100644
--- a/workflow-templates/labeler.yml
+++ b/workflow-templates/labeler.yml
@@ -16,7 +16,7 @@ permissions:
 
 jobs:
   labeler:
-    uses: DevSecNinja/.github/.github/workflows/labeler.yml@0d0f448de257f354c89dc3a128871235d6ba8c11 # v2.5.0
+    uses: DevSecNinja/.github/.github/workflows/labeler.yml@24acc67adf1be33089e73b2fdbdb4be8c12d145b # v3.2.0
     permissions:
       contents: read
       pull-requests: write
diff --git a/workflow-templates/lint.yml b/workflow-templates/lint.yml
index 2186e1c..ebfa757 100644
--- a/workflow-templates/lint.yml
+++ b/workflow-templates/lint.yml
@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   lint:
-    uses: DevSecNinja/.github/.github/workflows/lint.yml@0d0f448de257f354c89dc3a128871235d6ba8c11 # v2.5.0
+    uses: DevSecNinja/.github/.github/workflows/lint.yml@24acc67adf1be33089e73b2fdbdb4be8c12d145b # v3.2.0
     permissions:
       contents: read
       security-events: write
diff --git a/workflow-templates/pages.yml b/workflow-templates/pages.yml
index 4a427ef..117dc9f 100644
--- a/workflow-templates/pages.yml
+++ b/workflow-templates/pages.yml
@@ -20,7 +20,7 @@ permissions:
   contents: read
 jobs:
   pages:
-    uses: DevSecNinja/.github/.github/workflows/pages.yml@7a3e8e1475c658c60c23bedc7daf2e559bfe60b4 # v3.1.0
+    uses: DevSecNinja/.github/.github/workflows/pages.yml@24acc67adf1be33089e73b2fdbdb4be8c12d145b # v3.2.0
     permissions:
       contents: read
       deployments: write
diff --git a/workflow-templates/release-please.yml b/workflow-templates/release-please.yml
index b21f787..111ba60 100644
--- a/workflow-templates/release-please.yml
+++ b/workflow-templates/release-please.yml
@@ -32,7 +32,7 @@ permissions:
 
 jobs:
   release-please:
-    uses: DevSecNinja/.github/.github/workflows/release-please.yml@c61e8107b080f72e25bfc41d3eef947dbfa66446 # v3.0.0
+    uses: DevSecNinja/.github/.github/workflows/release-please.yml@24acc67adf1be33089e73b2fdbdb4be8c12d145b # v3.2.0
     permissions:
       contents: write
       pull-requests: write
diff --git a/workflow-templates/release.yml b/workflow-templates/release.yml
index f82e7b0..b211117 100644
--- a/workflow-templates/release.yml
+++ b/workflow-templates/release.yml
@@ -11,7 +11,7 @@ permissions:
 
 jobs:
   release:
-    uses: DevSecNinja/.github/.github/workflows/release.yml@0d0f448de257f354c89dc3a128871235d6ba8c11 # v2.5.0
+    uses: DevSecNinja/.github/.github/workflows/release.yml@24acc67adf1be33089e73b2fdbdb4be8c12d145b # v3.2.0
     permissions:
       contents: write
     with:
diff --git a/workflow-templates/todo-to-issue.yml b/workflow-templates/todo-to-issue.yml
index 3881634..f947378 100644
--- a/workflow-templates/todo-to-issue.yml
+++ b/workflow-templates/todo-to-issue.yml
@@ -12,7 +12,7 @@ permissions:
 
 jobs:
   run:
-    uses: DevSecNinja/.github/.github/workflows/todo-to-issue.yml@0d0f448de257f354c89dc3a128871235d6ba8c11 # v2.5.0
+    uses: DevSecNinja/.github/.github/workflows/todo-to-issue.yml@24acc67adf1be33089e73b2fdbdb4be8c12d145b # v3.2.0
     permissions:
       contents: read
       issues: write