diff --git a/.github/workflows/protobuf.yml b/.github/workflows/protobuf.yml
index 502ef464dc0ac..2330f4b57d31a 100644
--- a/.github/workflows/protobuf.yml
+++ b/.github/workflows/protobuf.yml
@@ -26,7 +26,7 @@ jobs:
       # Run `git checkout`
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       # Perform breaking change detection against the `master` branch
-      - uses: bufbuild/buf-action@8c6a16e16f12ba20b6470afa9c2ba9b5ba8c97c3 # v1.5.0
+      - uses: bufbuild/buf-action@85aebf73123b5c15fd5528aaecbf9129cddf7fa7 # v1.6.0
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           lint: false
diff --git a/.github/workflows/release_housekeeping.yml b/.github/workflows/release_housekeeping.yml
index 96b6395208542..14e41f690b7b8 100644
--- a/.github/workflows/release_housekeeping.yml
+++ b/.github/workflows/release_housekeeping.yml
@@ -28,7 +28,7 @@ jobs:
       RELEASE_COMMIT: ${{ inputs.release_commit }}
     steps:
       - name: Checkout master
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: master
           fetch-depth: 0
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index ca14a19069f6c..44c40fd54d504 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -68,6 +68,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/spelling.yml b/.github/workflows/spelling.yml
index 224fadf69f489..e89079254d310 100644
--- a/.github/workflows/spelling.yml
+++ b/.github/workflows/spelling.yml
@@ -23,4 +23,4 @@ jobs:
       cancel-in-progress: true
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
-      - uses: crate-ci/typos@512fc24f32f44ab01972217aaaf3dc86ec234d53 # v1.50.2
+      - uses: crate-ci/typos@00f422f3b19c57bc6338715ebfe3316d38768461 # v1.50.3