diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d732e11..8fe30c7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -51,7 +51,7 @@ jobs:
           components: rustfmt, clippy
 
       - name: Cache Rust Builds
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
 
       - name: Lint
         run: |
@@ -83,7 +83,7 @@ jobs:
           toolchain: stable
 
       - name: Cache Rust Builds
-        uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
+        uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
 
       - name: Run Tests
         env:
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index cf69441..b3d5e02 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -488,9 +488,9 @@ jobs:
       # The nanopb version must match the one the checked-in codec was
       # generated with (its header names it) and the one build.zig fetches.
       - name: Setup Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
-          python-version: '3.14'
+          python-version: '3.15'
 
       - name: Setup nanopb_generator
         run: pip install nanopb==0.4.9.1
@@ -604,9 +604,9 @@ jobs:
       # The nanopb version must match the one the checked-in codec was
       # generated with (its header names it) and the one build.zig fetches.
       - name: Setup Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
-          python-version: '3.14'
+          python-version: '3.15'
 
       - name: Setup nanopb_generator
         run: pip install nanopb==0.4.9.1
@@ -1014,7 +1014,7 @@ jobs:
       - name: Install Cosign
         uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
         with:
-          cosign-release: 'v3.1.3'
+          cosign-release: 'v3.1.4'
 
       - name: Setup the Crossplane CLI
         run: |
diff --git a/.github/workflows/grype-scan.yml b/.github/workflows/grype-scan.yml
index c747511..06ce9c9 100644
--- a/.github/workflows/grype-scan.yml
+++ b/.github/workflows/grype-scan.yml
@@ -51,7 +51,7 @@ jobs:
             -o sarif=grype-results.sarif
 
       - name: Upload SARIF Report
-        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           sarif_file: grype-results.sarif
           ref: refs/tags/${{ steps.release.outputs.tag }}