diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index f9a5246..d66993d 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -290,7 +290,7 @@ jobs:
         # Attestations stay on (the default): running in cd.yml makes both OIDC
         # claims resolve to cd.yml, so the PEP 740 attestation matches the cd.yml
         # trusted publisher.
-        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1
         with:
           packages-dir: packaging/pypi/dist
           skip-existing: true
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 74c423f..db9fc0b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -85,7 +85,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       # make codeguard-ci: CI intentionally runs the stable Marketplace action instead of the in-repo binary.
-      - uses: devr-tools/codeguard@v1.2.0
+      - uses: devr-tools/codeguard@v1.3.9
         with:
           config: .codeguard/codeguard.yaml
 
diff --git a/.github/workflows/homebrew-validation.yml b/.github/workflows/homebrew-validation.yml
index ae38ff1..f11e167 100644
--- a/.github/workflows/homebrew-validation.yml
+++ b/.github/workflows/homebrew-validation.yml
@@ -25,7 +25,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up Homebrew
-        uses: Homebrew/actions/setup-homebrew@df4b09108a1de9d6f995fe68f302b3f68bd6d2ef # main
+        uses: Homebrew/actions/setup-homebrew@9af03b7ae3f9e2ae5c174f659d5c3909f7e7dbac # main
 
       - name: Clone Homebrew tap
         shell: bash
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 9d4b197..2b3ec68 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -188,7 +188,7 @@ jobs:
         uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0
 
       - name: Log in to GHCR
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}