diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 46e5416..a5476d7 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -100,7 +100,7 @@ jobs:
             echo "EOF_CODEQL_CONFIG"
           } >> "$GITHUB_OUTPUT"
 
-      - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+      - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ steps.mode.outputs.mode }}
@@ -113,6 +113,6 @@ jobs:
           GO_BUILD: ${{ inputs.go-build-command }}
         run: bash -euo pipefail -c "$GO_BUILD"
 
-      - uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+      - uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           category: /language:${{ matrix.language }}
diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 8b1a38c..12cb037 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -307,7 +307,7 @@ jobs:
         uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -386,7 +386,7 @@ jobs:
         if: ${{ !cancelled() && inputs.scan && steps.scan.outputs.sarif != '' }}
         # Fork PRs cannot write security events; never fail the job on this.
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           sarif_file: ${{ steps.scan.outputs.sarif }}
           category: anchore-${{ steps.prepare.outputs.slug }}
diff --git a/.github/workflows/ghcr-cleanup.yml b/.github/workflows/ghcr-cleanup.yml
index 5e24666..f023eec 100644
--- a/.github/workflows/ghcr-cleanup.yml
+++ b/.github/workflows/ghcr-cleanup.yml
@@ -65,7 +65,7 @@ jobs:
       cancel-in-progress: false
     steps:
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
diff --git a/.github/workflows/image-rescan.yml b/.github/workflows/image-rescan.yml
index e52e11d..bd1c316 100644
--- a/.github/workflows/image-rescan.yml
+++ b/.github/workflows/image-rescan.yml
@@ -48,7 +48,7 @@ jobs:
       empty: ${{ steps.resolve.outputs.empty }}
     steps:
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -109,7 +109,7 @@ jobs:
       matrix: ${{ fromJSON(needs.resolve.outputs.matrix) }}
     steps:
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -129,7 +129,7 @@ jobs:
       - name: Upload scan results to code scanning
         if: ${{ !cancelled() && steps.scan.outputs.sarif != '' }}
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
+        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           sarif_file: ${{ steps.scan.outputs.sarif }}
           category: rescan-${{ matrix.tag }}-${{ matrix.platform }}
diff --git a/.github/workflows/workflow-lint.yml b/.github/workflows/workflow-lint.yml
index 7f82e17..786fb6e 100644
--- a/.github/workflows/workflow-lint.yml
+++ b/.github/workflows/workflow-lint.yml
@@ -94,7 +94,7 @@ jobs:
           echo "config=$cfg" >> "$GITHUB_OUTPUT"
 
       - name: zizmor
-        uses: zizmorcore/zizmor-action@f9597c869b2e67095f9b527070297a13a6efe928 # v0.7.0
+        uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
         with:
           version: ${{ inputs.zizmor-version }}
           inputs: ${{ inputs.paths }}