diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 52896bcd..dbfa3b33 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -20,7 +20,7 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Check Tabs
       run: |
@@ -45,7 +45,7 @@ jobs:
     runs-on: ${{matrix.os}}
 
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Create Build Directory
       run: cmake -E make_directory ${{runner.workspace}}/build
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 9dd5e5e7..7d877beb 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -29,10 +29,10 @@ jobs:
       security-events: write
 
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+      uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
       with:
         languages: cpp
         build-mode: manual
@@ -51,4 +51,4 @@ jobs:
       run: cmake --build . --parallel 4 --config $BUILD_TYPE
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+      uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c65dc950..29db2780 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -29,7 +29,7 @@ jobs:
       id-token: write
 
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     # This isn't working currently, see https://github.com/actions/checkout/issues/1467.
     # Instead, get the git information manually with the step below.
     #   with:
@@ -62,7 +62,7 @@ jobs:
 
     - name: Update Python (Windows)
       if: matrix.os == 'windows-latest'
-      uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: '3.12'
 
@@ -70,7 +70,7 @@ jobs:
       if: |
         startsWith(github.ref, 'refs/tags/') &&
         matrix.os == 'windows-latest'
-      uses: sigstore/gh-action-sigstore-python@5b79a39c381910c090341a2c9b0bf022c8b387e1 #v3.4.0
+      uses: sigstore/gh-action-sigstore-python@790bc6befb9d733738f18d8f895854b453640ec9 #v3.5.0
       with:
         inputs: |
           ./build/clintercept-*.zip
@@ -79,7 +79,7 @@ jobs:
       if: |
         startsWith(github.ref, 'refs/tags/') &&
         matrix.os == 'ubuntu-latest'
-      uses: sigstore/gh-action-sigstore-python@5b79a39c381910c090341a2c9b0bf022c8b387e1 #v3.4.0
+      uses: sigstore/gh-action-sigstore-python@790bc6befb9d733738f18d8f895854b453640ec9 #v3.5.0
       with:
         inputs: |
           ./build/clintercept-*.tar.gz
@@ -88,7 +88,7 @@ jobs:
       if: |
         startsWith(github.ref, 'refs/tags/') &&
         matrix.os == 'windows-latest'
-      uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
+      uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
       with:
         draft: true
         files: |
@@ -99,7 +99,7 @@ jobs:
       if: |
         startsWith(github.ref, 'refs/tags/') &&
         matrix.os == 'ubuntu-latest'
-      uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
+      uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
       with:
         draft: true
         files: |