diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index 10539b3..484ba72 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -114,7 +114,7 @@ jobs:
       # SBOM per image — attached to the registry alongside the signature.
       - name: Generate SBOM for CLI image
         if: github.event_name != 'pull_request' && steps.docker-creds.outputs.present == 'true' && steps.build-cli.outputs.digest != ''
-        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
         with:
           image: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build-cli.outputs.digest }}
           format: cyclonedx-json
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 336be88..9e5336c 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -426,7 +426,7 @@ jobs:
       - name: Generate SBOM (CycloneDX)
         # CycloneDX SBOM is required by EU CRA and US EO 14028 for shipped
         # software. Lets downstream consumers introspect the dep tree.
-        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
         with:
           path: .
           config: .syft.yaml # names the root component (see the step above)
@@ -436,7 +436,7 @@ jobs:
 
       - name: Generate SBOM (SPDX)
         # Some consumers (e.g. RHEL, federal) require SPDX format.
-        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
         with:
           path: .
           config: .syft.yaml # names the root component (see the step above)
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 6b87d58..ac57e84 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -188,7 +188,7 @@ jobs:
       - name: Checkov (terraform + kubernetes)
         # Baseline of pre-existing findings in .checkov.yaml skip-check.
         # Gating on net-new findings only — see .checkov.yaml header for context.
-        uses: bridgecrewio/checkov-action@59b9d7edfcad5b87fbe3f473a9a134a721ad03f8 # v12.3119.0
+        uses: bridgecrewio/checkov-action@f967808197a8d784d3e72919f38c3ff0cda7884e # v12.3122.0
         with:
           directory: .
           config_file: .checkov.yaml
@@ -331,7 +331,7 @@ jobs:
           node-version: "22"
           cache: "npm"
       - run: npm ci && npm run build
-      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518 # v4.2.5
+      - uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
       - name: Provision declared tools via kit install (triage-gated)
         run: node dist/cli.js install
         continue-on-error: true # kit-self-audit: allow-continue-on-error