diff --git a/.github/workflows/claude-responder.yml b/.github/workflows/claude-responder.yml
index ccf489c..b2f5d39 100644
--- a/.github/workflows/claude-responder.yml
+++ b/.github/workflows/claude-responder.yml
@@ -68,7 +68,7 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@dcb57747bfceeaa1fa72638cae52295d1d853d4a # v1
+        uses: anthropics/claude-code-action@d75b94d5ad426cb8546e6628b6f5f19b84e5cce1 # v1
         env:
           CLAUDE_CODE_MAX_OUTPUT_TOKENS: ${{ inputs.output_max_tokens }}
         with:
diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml
index 3be35a5..18a2fad 100644
--- a/.github/workflows/claude-review.yml
+++ b/.github/workflows/claude-review.yml
@@ -65,7 +65,7 @@ jobs:
       - name: Run Claude Code Review
         id: claude
         continue-on-error: true
-        uses: anthropics/claude-code-action@dcb57747bfceeaa1fa72638cae52295d1d853d4a # v1
+        uses: anthropics/claude-code-action@d75b94d5ad426cb8546e6628b6f5f19b84e5cce1 # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           allowed_bots: ${{ inputs.allowed_bots }}
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 925fd44..639e29a 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -56,6 +56,6 @@ jobs:
           retention-days: 5
 
       - name: Upload to code-scanning dashboard
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/site-deploy.yml b/.github/workflows/site-deploy.yml
index fc04659..e66d6da 100644
--- a/.github/workflows/site-deploy.yml
+++ b/.github/workflows/site-deploy.yml
@@ -119,7 +119,7 @@ jobs:
         run: npm run build
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
+        uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4
         with:
           role-to-assume: ${{ inputs.role_arn }}
           aws-region: ${{ inputs.aws_region }}
diff --git a/.github/workflows/tf-lint.yml b/.github/workflows/tf-lint.yml
index 6c8cb0c..520f219 100644
--- a/.github/workflows/tf-lint.yml
+++ b/.github/workflows/tf-lint.yml
@@ -100,7 +100,7 @@ jobs:
       # ── Gate 3: tflint ───────────────────────────────────────────────────
       - name: Setup tflint
         if: inputs.enable_tflint
-        uses: terraform-linters/setup-tflint@6e1e0642c0289bd619021bf6b34e3c08ed1e005a # v6.3.0
+        uses: terraform-linters/setup-tflint@1cf010d3c7aef302051ccdb68c14c5dc2efa34ef # v6.3.1
         with:
           tflint_version: ${{ inputs.tflint_version }}