diff --git a/.github/workflows/_binary_upload.yml b/.github/workflows/_binary_upload.yml
index cb5dbb6cc7..6f0972c858 100644
--- a/.github/workflows/_binary_upload.yml
+++ b/.github/workflows/_binary_upload.yml
@@ -86,14 +86,14 @@ jobs:
 
       - name: Configure aws credentials (pytorch account)
         if: ${{ inputs.trigger-event == 'schedule' || (inputs.trigger-event == 'push' && startsWith(github.event.ref, 'refs/heads/nightly')) }}
-        uses: aws-actions/configure-aws-credentials@50ac8dd1e1b10d09dac7b8727528b91bed831ac0 # v3.0.2
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708  # v5
         with:
           role-to-assume: arn:aws:iam::749337293305:role/${{ (inputs.wheel-nightly-policy != '' && inputs.wheel-nightly-policy) || 'gha_workflow_nightly_build_wheels'}}
           aws-region: us-east-1
 
       - name: Configure aws credentials (pytorch account)
         if: ${{ env.CHANNEL == 'test' && startsWith(github.event.ref, 'refs/tags/v') }}
-        uses: aws-actions/configure-aws-credentials@50ac8dd1e1b10d09dac7b8727528b91bed831ac0 # v3.0.2
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708  # v5
         with:
           role-to-assume: arn:aws:iam::749337293305:role/gha_workflow_test_build_wheels
           aws-region: us-east-1
diff --git a/.github/workflows/backfill-workflow-job.yml b/.github/workflows/backfill-workflow-job.yml
index 981c835d9d..37bdf12881 100644
--- a/.github/workflows/backfill-workflow-job.yml
+++ b/.github/workflows/backfill-workflow-job.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: configure aws credentials
-        uses: aws-actions/configure-aws-credentials@67fbcbb121271f7775d2e7715933280b06314838 # v1.7.0
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708  # v5
         with:
           role-to-assume: arn:aws:iam::308535385114:role/gha_workflow_backfill-workflow-job
           aws-region: us-east-1
diff --git a/.github/workflows/build-windows-ami.yml b/.github/workflows/build-windows-ami.yml
index e9dedb3bca..1c0745846d 100644
--- a/.github/workflows/build-windows-ami.yml
+++ b/.github/workflows/build-windows-ami.yml
@@ -30,7 +30,7 @@ jobs:
           ref: ${{ inputs.branch }}
 
       - name: Configure AWS Credentials (PyTorch Account)
-        uses: aws-actions/configure-aws-credentials@50ac8dd1e1b10d09dac7b8727528b91bed831ac0 # v3.0.2
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708  # v5
         with:
           aws-region: us-east-1
           role-to-assume: arn:aws:iam::391835788720:role/gha-packer-role
diff --git a/.github/workflows/clickhouse-replicator-dynamo-lambda.yml b/.github/workflows/clickhouse-replicator-dynamo-lambda.yml
index b80110a764..15401e0f6e 100644
--- a/.github/workflows/clickhouse-replicator-dynamo-lambda.yml
+++ b/.github/workflows/clickhouse-replicator-dynamo-lambda.yml
@@ -25,7 +25,7 @@ jobs:
           python-version: '3.12'
           cache: pip
       - name: configure aws credentials
-        uses: aws-actions/configure-aws-credentials@67fbcbb121271f7775d2e7715933280b06314838 # v1.7.0
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708  # v5
         with:
           role-to-assume: arn:aws:iam::308535385114:role/gha_deploy_clickhouse_replicator_lambdas
           aws-region: us-east-1
diff --git a/.github/workflows/clickhouse-replicator-s3-lambda.yml b/.github/workflows/clickhouse-replicator-s3-lambda.yml
index cfc0370cde..d5d9af8270 100644
--- a/.github/workflows/clickhouse-replicator-s3-lambda.yml
+++ b/.github/workflows/clickhouse-replicator-s3-lambda.yml
@@ -25,7 +25,7 @@ jobs:
           python-version: '3.12'
           cache: pip
       - name: configure aws credentials
-        uses: aws-actions/configure-aws-credentials@67fbcbb121271f7775d2e7715933280b06314838 # v1.7.0
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708  # v5
         with:
           role-to-assume: arn:aws:iam::308535385114:role/gha_deploy_clickhouse_replicator_lambdas
           aws-region: us-east-1
diff --git a/.github/workflows/deploy_lambda_whl_metadata_upload_pep658.yml b/.github/workflows/deploy_lambda_whl_metadata_upload_pep658.yml
index 9caa96ca12..9c12eb239d 100644
--- a/.github/workflows/deploy_lambda_whl_metadata_upload_pep658.yml
+++ b/.github/workflows/deploy_lambda_whl_metadata_upload_pep658.yml
@@ -41,7 +41,7 @@ jobs:
           python-version: '3.13'
           cache: pip
       - name: configure aws credentials
-        uses: aws-actions/configure-aws-credentials@67fbcbb121271f7775d2e7715933280b06314838 # v1.7.0
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708  # v5
         with:
           role-to-assume: arn:aws:iam::749337293305:role/gha_workflow_whl_metadata_upload_pep658
           aws-region: us-east-1
diff --git a/.github/workflows/gha-artifacts-lambda.yml b/.github/workflows/gha-artifacts-lambda.yml
index f49530bd7b..0ed1997614 100644
--- a/.github/workflows/gha-artifacts-lambda.yml
+++ b/.github/workflows/gha-artifacts-lambda.yml
@@ -42,7 +42,7 @@ jobs:
           python-version: '3.12'
           cache: pip
       - name: configure aws credentials
-        uses: aws-actions/configure-aws-credentials@67fbcbb121271f7775d2e7715933280b06314838 # v1.7.0
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708  # v5
         with:
           role-to-assume: arn:aws:iam::308535385114:role/gha_workflow_gha-artifacts-lambda
           aws-region: us-east-1
diff --git a/.github/workflows/github-status-test-lambda.yml b/.github/workflows/github-status-test-lambda.yml
index e463c004ff..b17e98e033 100644
--- a/.github/workflows/github-status-test-lambda.yml
+++ b/.github/workflows/github-status-test-lambda.yml
@@ -25,7 +25,7 @@ jobs:
       contents: read
     steps:
       - name: configure aws credentials
-        uses: aws-actions/configure-aws-credentials@67fbcbb121271f7775d2e7715933280b06314838 # v1.7.0
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708  # v5
         with:
           role-to-assume: arn:aws:iam::308535385114:role/gha_workflow_github-status-test-lambda
           aws-region: us-east-1
diff --git a/.github/workflows/log-classifier-lambda.yml b/.github/workflows/log-classifier-lambda.yml
index 845d3f4a8d..6fb86cf42b 100644
--- a/.github/workflows/log-classifier-lambda.yml
+++ b/.github/workflows/log-classifier-lambda.yml
@@ -33,7 +33,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       - name: configure aws credentials
-        uses: aws-actions/configure-aws-credentials@67fbcbb121271f7775d2e7715933280b06314838 # v1.7.0
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708  # v5
         with:
           role-to-assume: arn:aws:iam::308535385114:role/gha_workflow_log-classifier-lambda
           aws-region: us-east-1
diff --git a/.github/workflows/mobile_job.yml b/.github/workflows/mobile_job.yml
index 72ee3d6c3d..5c79d274d5 100644
--- a/.github/workflows/mobile_job.yml
+++ b/.github/workflows/mobile_job.yml
@@ -124,7 +124,7 @@ jobs:
           echo "::endgroup::"
 
       - name: Authenticate with AWS
-        uses: aws-actions/configure-aws-credentials@50ac8dd1e1b10d09dac7b8727528b91bed831ac0 # v3.0.2
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708  # v5
         with:
           role-to-assume: arn:aws:iam::308535385114:role/gha_workflow_mobile_job
           # The max duration enforced by the server side
diff --git a/.github/workflows/opensearch-gha-jobs-lambda.yml b/.github/workflows/opensearch-gha-jobs-lambda.yml
index a619325b6b..f05a169812 100644
--- a/.github/workflows/opensearch-gha-jobs-lambda.yml
+++ b/.github/workflows/opensearch-gha-jobs-lambda.yml
@@ -41,7 +41,7 @@ jobs:
           python-version: '3.11'
           cache: pip
       - name: configure aws credentials
-        uses: aws-actions/configure-aws-credentials@67fbcbb121271f7775d2e7715933280b06314838 # v1.7.0
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708  # v5
         with:
           role-to-assume: arn:aws:iam::308535385114:role/gha_workflow_opensearch-gha-jobs-lambda
           aws-region: us-east-1
diff --git a/.github/workflows/release-download-pytorch-org.yml b/.github/workflows/release-download-pytorch-org.yml
index 1525eaf7fe..485cbbe876 100644
--- a/.github/workflows/release-download-pytorch-org.yml
+++ b/.github/workflows/release-download-pytorch-org.yml
@@ -40,7 +40,7 @@ jobs:
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Configure aws credentials (pytorch account)
-        uses: aws-actions/configure-aws-credentials@50ac8dd1e1b10d09dac7b8727528b91bed831ac0 # v3.0.2
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708  # v5
         with:
           role-to-assume: arn:aws:iam::749337293305:role/gha_workflow_promote_wheels
           aws-region: us-east-1
diff --git a/.github/workflows/release-pypi.yml b/.github/workflows/release-pypi.yml
index fc3dc6f7da..5aadc64130 100644
--- a/.github/workflows/release-pypi.yml
+++ b/.github/workflows/release-pypi.yml
@@ -34,7 +34,7 @@ jobs:
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Configure aws credentials (pytorch account)
-        uses: aws-actions/configure-aws-credentials@50ac8dd1e1b10d09dac7b8727528b91bed831ac0 # v3.0.2
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708  # v5
         with:
           role-to-assume: arn:aws:iam::749337293305:role/gha_workflow_stage_wheels
           aws-region: us-east-1
@@ -65,6 +65,6 @@ jobs:
         run: ls -R dist/
       - name: Publish package to PyPI
         if: ${{ inputs.dryrun == 'disabled' }}
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e  # release/v1.13
         with:
           verbose: true
diff --git a/.github/workflows/release-stage-pypi.yml b/.github/workflows/release-stage-pypi.yml
index 7fdffb479f..70ebe70dde 100644
--- a/.github/workflows/release-stage-pypi.yml
+++ b/.github/workflows/release-stage-pypi.yml
@@ -35,7 +35,7 @@ jobs:
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Configure aws credentials (pytorch account)
-        uses: aws-actions/configure-aws-credentials@50ac8dd1e1b10d09dac7b8727528b91bed831ac0 # v3.0.2
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708  # v5
         with:
           role-to-assume: arn:aws:iam::749337293305:role/gha_workflow_stage_wheels
           aws-region: us-east-1
diff --git a/.github/workflows/servicelab-ingestor-lambda.yml b/.github/workflows/servicelab-ingestor-lambda.yml
index 8e90036a58..70be74c90a 100644
--- a/.github/workflows/servicelab-ingestor-lambda.yml
+++ b/.github/workflows/servicelab-ingestor-lambda.yml
@@ -25,7 +25,7 @@ jobs:
           python-version: '3.12'
           cache: pip
       - name: configure aws credentials
-        uses: aws-actions/configure-aws-credentials@67fbcbb121271f7775d2e7715933280b06314838 # v1.7.0
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708  # v5
         with:
           role-to-assume: arn:aws:iam::308535385114:role/gha_workflow_servicelab-ingestor-lambda
           aws-region: us-east-1
diff --git a/.github/workflows/update-queue-times.yml b/.github/workflows/update-queue-times.yml
index 27b0b07d5b..bcc21264df 100644
--- a/.github/workflows/update-queue-times.yml
+++ b/.github/workflows/update-queue-times.yml
@@ -19,7 +19,7 @@ jobs:
       - run: yarn install --frozen-lockfile
       - name: configure aws credentials
         id: aws_creds
-        uses: aws-actions/configure-aws-credentials@50ac8dd1e1b10d09dac7b8727528b91bed831ac0 # v3.0.2
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708  # v5
         with:
           role-to-assume: arn:aws:iam::308535385114:role/gha_workflow_update_queue_times
           aws-region: us-east-1
diff --git a/.github/workflows/update-s3-dependencies.yml b/.github/workflows/update-s3-dependencies.yml
index 7d297aed43..dff17ad8c3 100644
--- a/.github/workflows/update-s3-dependencies.yml
+++ b/.github/workflows/update-s3-dependencies.yml
@@ -36,7 +36,7 @@ jobs:
     steps:
       - name: configure aws credentials
         id: aws_creds
-        uses: aws-actions/configure-aws-credentials@50ac8dd1e1b10d09dac7b8727528b91bed831ac0 # v3.0.2
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708  # v5
         with:
           role-to-assume: arn:aws:iam::749337293305:role/gha_workflow_s3_update
           aws-region: us-east-1
diff --git a/.github/workflows/update-s3-html.yml b/.github/workflows/update-s3-html.yml
index 61b159fa34..3771c4a3d1 100644
--- a/.github/workflows/update-s3-html.yml
+++ b/.github/workflows/update-s3-html.yml
@@ -24,7 +24,7 @@ jobs:
     steps:
       - name: configure aws credentials
         id: aws_creds
-        uses: aws-actions/configure-aws-credentials@50ac8dd1e1b10d09dac7b8727528b91bed831ac0 # v3.0.2
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708  # v5
         with:
           role-to-assume: arn:aws:iam::749337293305:role/gha_workflow_s3_update
           aws-region: us-east-1
diff --git a/.github/workflows/update_test_file_ratings.yml b/.github/workflows/update_test_file_ratings.yml
index 14e1cad664..2f1dd1bf5e 100644
--- a/.github/workflows/update_test_file_ratings.yml
+++ b/.github/workflows/update_test_file_ratings.yml
@@ -36,7 +36,7 @@ jobs:
           pip3 install -e .
 
       - name: configure aws credentials
-        uses: aws-actions/configure-aws-credentials@50ac8dd1e1b10d09dac7b8727528b91bed831ac0 # v3.0.2
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708  # v5
         with:
           role-to-assume: arn:aws:iam::308535385114:role/upload_to_ossci_raw_job_status
           aws-region: us-east-1
diff --git a/.github/workflows/upload-tutorials-stats.yml b/.github/workflows/upload-tutorials-stats.yml
index 0c10e149db..b88a80f5a9 100644
--- a/.github/workflows/upload-tutorials-stats.yml
+++ b/.github/workflows/upload-tutorials-stats.yml
@@ -16,7 +16,7 @@ jobs:
     steps:
       - name: Configure aws credentials
         id: aws_creds
-        uses: aws-actions/configure-aws-credentials@ececac1a45f3b08a01d2dd070d28d111c5fe6722 # v4.1.0
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708  # v5
         with:
           role-to-assume: arn:aws:iam::308535385114:role/gha_workflow_upload-tutorials-stats
           aws-region: us-east-1
diff --git a/.github/workflows/usage-log-aggregator-lambda.yml b/.github/workflows/usage-log-aggregator-lambda.yml
index 110bf18200..74ecb79ac6 100644
--- a/.github/workflows/usage-log-aggregator-lambda.yml
+++ b/.github/workflows/usage-log-aggregator-lambda.yml
@@ -42,7 +42,7 @@ jobs:
           python-version: '3.12'
           cache: pip
       - name: configure aws credentials
-        uses: aws-actions/configure-aws-credentials@67fbcbb121271f7775d2e7715933280b06314838 # v1.7.0
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708  # v5
         with:
           role-to-assume: arn:aws:iam::308535385114:role/gha_workflow_usage-log-aggregator-lambda
           aws-region: us-east-1