diff --git a/.github/workflows/assertion.yml b/.github/workflows/assertion.yml
index d86821180..032808598 100644
--- a/.github/workflows/assertion.yml
+++ b/.github/workflows/assertion.yml
@@ -68,7 +68,7 @@ jobs:
 
       - name: Generate Assertion Document
         id: assertiondoc
-        uses: nginx/compliance-rules/.github/actions/assertion@eb7c8e7560d14e70266b934c32b7becaa3beeeed # v0.3.5
+        uses: nginx/compliance-rules/.github/actions/assertion@c38f5c071ce50e37cbfb59e7c10eff5751d252d6 # v0.3.6
         with:
           artifact-name: nginx-agent_${{ inputs.packageVersion }}_${{ matrix.osarch }}
           artifact-digest: ${{ env.agent-digest }}
@@ -88,6 +88,6 @@ jobs:
       - name: Sign and Store Assertion Document
         id: sign
         if: ${{ inputs.signAssertion == true }}
-        uses: nginx/compliance-rules/.github/actions/sign@eb7c8e7560d14e70266b934c32b7becaa3beeeed # v0.3.5
+        uses: nginx/compliance-rules/.github/actions/sign@c38f5c071ce50e37cbfb59e7c10eff5751d252d6 # v0.3.6
         with:
           assertion-doc: ${{ steps.assertiondoc.outputs.assertion-document-path }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c3f43f2e9..262e4e13d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -98,7 +98,7 @@ jobs:
       - name: Lint Go
         uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         with:
-          version: v2.13.2
+          version: v2.14.0
           skip-cache: true
 
   vulnerability-scan:
diff --git a/.github/workflows/label-pr.yml b/.github/workflows/label-pr.yml
index 9b86082bb..4f154eba3 100644
--- a/.github/workflows/label-pr.yml
+++ b/.github/workflows/label-pr.yml
@@ -14,6 +14,6 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-26.04
     steps:
-      - uses: release-drafter/release-drafter/autolabeler@34d80673e067bdc0c24568d3af899c216adcfaa9 # v7.7.0
+      - uses: release-drafter/release-drafter/autolabeler@72967cdc98ddd3160f1fc3dff619de365e137dd0 # v7.9.0
         env:
           GITHUB_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/mend.yml b/.github/workflows/mend.yml
index fe9b74d96..dedcbf566 100644
--- a/.github/workflows/mend.yml
+++ b/.github/workflows/mend.yml
@@ -30,7 +30,7 @@ jobs:
         (github.event_name == 'pull_request' && !github.event.pull_request.head.repo.fork && !startsWith(github.head_ref, 'dependabot-') && !startsWith(github.head_ref, 'renovate/')) ||
         (github.event_name == 'push' && !github.event.repository.fork)
       }}
-    uses: nginx/compliance-rules/.github/workflows/mend.yml@eb7c8e7560d14e70266b934c32b7becaa3beeeed # v0.3.5
+    uses: nginx/compliance-rules/.github/workflows/mend.yml@c38f5c071ce50e37cbfb59e7c10eff5751d252d6 # v0.3.6
     secrets: inherit
     with:
       product_name: nginx-agent-v3_${{ github.ref_name }}