diff --git a/.github/workflows/auto-label.yml b/.github/workflows/auto-label.yml
index c18e72cf2..3bd3176b4 100644
--- a/.github/workflows/auto-label.yml
+++ b/.github/workflows/auto-label.yml
@@ -32,7 +32,7 @@ jobs:
 
       - name: Size labeling for PRs
         if: github.event_name == 'pull_request_target'
-        uses: codelytv/pr-size-labeler@095a41fca88b8764fd9e008ad269bcdb82bb38b9 # v1.10.4
+        uses: codelytv/pr-size-labeler@19c335e7695ba922de938806dd129f0a9b992644 # v1.12.0
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           xs_label: 'size/xs'
diff --git a/.github/workflows/claude-pr-review.yml b/.github/workflows/claude-pr-review.yml
index 69a3a0038..aada35d90 100644
--- a/.github/workflows/claude-pr-review.yml
+++ b/.github/workflows/claude-pr-review.yml
@@ -39,7 +39,7 @@ jobs:
           persist-credentials: false
 
       - name: Run the reviewer agent
-        uses: anthropics/claude-code-action@cab360f6565aa35a51d6ce9e43f1f4287c0a32ea # v1.0.241
+        uses: anthropics/claude-code-action@6c690188da61cf16ee7debb28383ba67f02abb4c # v1.0.242
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           trigger_phrase: "@claude-pr-review"
diff --git a/.github/workflows/security-analysis.yml b/.github/workflows/security-analysis.yml
index ec50179f2..beeac41e8 100644
--- a/.github/workflows/security-analysis.yml
+++ b/.github/workflows/security-analysis.yml
@@ -86,7 +86,7 @@ jobs:
         persist-credentials: false
 
     - name: Run TruffleHog OSS
-      uses: trufflesecurity/trufflehog@4dd8831c5f12599465d4d45c3c447b4018a34c85 # v3.97.9
+      uses: trufflesecurity/trufflehog@0186870afd2c4a90def791d80260923ba583d076 # v3.98.0
       with:
         path: ./
         # `--exclude-detectors=lob`: TruffleHog's Lob key pattern is