diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ac5d1f4..e4893e0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -63,7 +63,7 @@ jobs:
           python scripts/artifacts.py validate-lock artifacts/locks/arm64.json
 
       - name: Audit GitHub Actions security
-        uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
         with:
           advanced-security: false
           annotations: true
@@ -120,7 +120,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
         with:
           driver: docker
 
@@ -227,7 +227,7 @@ jobs:
           severity: CRITICAL,HIGH
 
       - name: Generate SPDX SBOM with Syft
-        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
+        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
         with:
           image: ${{ env.TEST_IMAGE }}
           format: spdx-json
@@ -269,7 +269,7 @@ jobs:
 
       - name: Retain image security artifacts
         if: ${{ always() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: image-security-${{ github.sha }}-${{ matrix.architecture }}
           path: |
@@ -283,7 +283,7 @@ jobs:
 
       - name: Publish Grype findings to code scanning
         if: ${{ always() && github.event_name != 'pull_request' && hashFiles(env.GRYPE_SARIF) != '' }}
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           sarif_file: ${{ env.GRYPE_SARIF }}
           category: grype-image-${{ matrix.architecture }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 3ba1e4f..37c72b1 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -35,13 +35,13 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           languages: actions
           build-mode: none
           queries: security-extended
 
       - name: Analyze GitHub Actions
-        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           category: /language:actions
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index b9c2216..f9bc74c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -97,7 +97,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Confirm native runner architecture
         env:
@@ -157,7 +157,7 @@ jobs:
           test -s "${OCI_ARCHIVE}"
 
       - name: Generate downloadable architecture SPDX SBOM
-        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
+        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
         with:
           image: oci-archive:${{ env.OCI_ARCHIVE }}
           format: spdx-json
@@ -217,7 +217,7 @@ jobs:
           cp "artifacts/locks/${ARCHITECTURE}.json" "artifact-lock-${ARCHITECTURE}.json"
 
       - name: Retain candidate OCI archive for promotion
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-image-${{ github.sha }}-${{ matrix.architecture }}
           path: ${{ env.OCI_ARCHIVE }}
@@ -226,7 +226,7 @@ jobs:
 
       - name: Retain complete architecture evidence
         if: ${{ always() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-evidence-${{ github.sha }}-${{ matrix.architecture }}
           path: |
@@ -257,14 +257,14 @@ jobs:
       arm64_digest: ${{ steps.push.outputs.arm64_digest }}
     steps:
       - name: Download exact native OCI candidates
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: release-image-${{ github.sha }}-*
           path: candidates
           merge-multiple: true
 
       - name: Install ORAS
-        uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d # v2.0.1
+        uses: oras-project/setup-oras@005458ad77f1c8facd38a094e4af2e69e5607ff4 # v2.0.2
         with:
           version: 1.3.3
 
@@ -357,7 +357,7 @@ jobs:
           severity: UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL
 
       - name: Generate manifest SPDX SBOM
-        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
+        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
         with:
           image: ${{ env.IMAGE }}@${{ needs.publish.outputs.digest }}
           format: spdx-json
@@ -391,13 +391,13 @@ jobs:
           grype-version: v0.118.0
 
       - name: Upload code-scanning evidence
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           sarif_file: grype-index.sarif
           category: grype-release-image
 
       - name: Retain manifest evidence
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-evidence-${{ github.sha }}-manifest
           path: |
@@ -420,7 +420,7 @@ jobs:
       packages: write
     steps:
       - name: Download complete evidence
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: release-evidence-${{ github.sha }}-*
           path: evidence
@@ -484,7 +484,7 @@ jobs:
             --bundle manifest-sbom.sigstore.json "${IMAGE}@${DIGEST}"
 
       - name: Retain signature and attestation bundles
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-signatures-${{ github.sha }}
           path: |
@@ -504,7 +504,7 @@ jobs:
       contents: write
     steps:
       - name: Download release signatures
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: release-signatures-${{ github.sha }}
           path: release-assets
diff --git a/.github/workflows/scap.yml b/.github/workflows/scap.yml
index 6296eae..e788db5 100644
--- a/.github/workflows/scap.yml
+++ b/.github/workflows/scap.yml
@@ -107,7 +107,7 @@ jobs:
 
       - name: Retain SCAP discovery evidence
         if: ${{ always() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: scap-discovery-${{ github.sha }}-${{ matrix.architecture }}
           path: |
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 3dec7e0..0b574c4 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -39,13 +39,13 @@ jobs:
           file_mode: git
 
       - name: Upload SARIF artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: openssf-scorecard-sarif
           path: results.sarif
           retention-days: 5
 
       - name: Upload results to code scanning
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/update-locks.yml b/.github/workflows/update-locks.yml
index 753df5b..d7ce0c2 100644
--- a/.github/workflows/update-locks.yml
+++ b/.github/workflows/update-locks.yml
@@ -65,7 +65,7 @@ jobs:
           python scripts/artifacts.py validate-lock "${ARCHITECTURE}.lock.json"
 
       - name: Retain candidate for maintainer review
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: artifact-lock-candidate-${{ matrix.architecture }}
           path: |
diff --git a/.github/workflows/update-monitor.yml b/.github/workflows/update-monitor.yml
index 5ec81a0..17facd1 100644
--- a/.github/workflows/update-monitor.yml
+++ b/.github/workflows/update-monitor.yml
@@ -46,7 +46,7 @@ jobs:
           fi
 
       - name: Retain the monitored result
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: upstream-update-report-${{ github.run_id }}
           path: update-report.md