diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index ee89f584..1ee234f7 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -32,7 +32,7 @@ jobs:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
+      uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
       with:
         languages: cpp
 
@@ -50,4 +50,4 @@ jobs:
       run: cmake --build . --parallel 4 --config $BUILD_TYPE
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@89a39a4e59826350b863aa6b6252a07ad50cf83e # v4.32.4
+      uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4.35.1
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f36e06d5..0b7d716b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -70,7 +70,7 @@ jobs:
       if: |
         startsWith(github.ref, 'refs/tags/') &&
         matrix.os == 'windows-latest'
-      uses: sigstore/gh-action-sigstore-python@a5caf349bc536fbef3668a10ed7f5cd309a4b53d #v3.2.0
+      uses: sigstore/gh-action-sigstore-python@04cffa1d795717b140764e8b640de88853c92acc #v3.3.0
       with:
         inputs: |
           ./build/clintercept-*.zip
@@ -79,7 +79,7 @@ jobs:
       if: |
         startsWith(github.ref, 'refs/tags/') &&
         matrix.os == 'ubuntu-latest'
-      uses: sigstore/gh-action-sigstore-python@a5caf349bc536fbef3668a10ed7f5cd309a4b53d #v3.2.0
+      uses: sigstore/gh-action-sigstore-python@04cffa1d795717b140764e8b640de88853c92acc #v3.3.0
       with:
         inputs: |
           ./build/clintercept-*.tar.gz
@@ -88,7 +88,7 @@ jobs:
       if: |
         startsWith(github.ref, 'refs/tags/') &&
         matrix.os == 'windows-latest'
-      uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
+      uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
       with:
         draft: true
         files: |
@@ -99,7 +99,7 @@ jobs:
       if: |
         startsWith(github.ref, 'refs/tags/') &&
         matrix.os == 'ubuntu-latest'
-      uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
+      uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
       with:
         draft: true
         files: |