diff --git a/.github/workflows/enforce-pr-labels.yml b/.github/workflows/enforce-pr-labels.yml
index e92c9cf3e5e04b..1325289079e34d 100644
--- a/.github/workflows/enforce-pr-labels.yml
+++ b/.github/workflows/enforce-pr-labels.yml
@@ -14,7 +14,7 @@ jobs:
         permissions:
             pull-requests: write
         steps:
-            - uses: mheap/github-action-required-labels@0ac283b4e65c1fb28ce6079dea5546ceca98ccbe # v5.5.2
+            - uses: mheap/github-action-required-labels@23e10fde7e062233401931a0eece796cd9bf3177 # v5.6.0
               with:
                   mode: exactly
                   count: 1
diff --git a/.github/workflows/pr-labeling-automation.yml b/.github/workflows/pr-labeling-automation.yml
index 1256a3ed24b7b0..2c2ba991cc1041 100644
--- a/.github/workflows/pr-labeling-automation.yml
+++ b/.github/workflows/pr-labeling-automation.yml
@@ -14,7 +14,7 @@ jobs:
             pull-requests: write
         runs-on: ubuntu-24.04
         steps:
-            - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
+            - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
               with:
                   dot: true
                   sync-labels: true
diff --git a/.github/workflows/reusable-workflow-lint.yml b/.github/workflows/reusable-workflow-lint.yml
index 0870e101d75efb..656c5940fa4eb2 100644
--- a/.github/workflows/reusable-workflow-lint.yml
+++ b/.github/workflows/reusable-workflow-lint.yml
@@ -59,7 +59,7 @@ jobs:
                   GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
             - name: Upload SARIF file
-              uses: github/codeql-action/upload-sarif@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0
+              uses: github/codeql-action/upload-sarif@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
               with:
                   sarif_file: results.sarif
                   category: zizmor