diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 8db0d28..07d8fb6 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -87,7 +87,7 @@ jobs:
       # rather than watching a compiler. Written here rather than left to a
       # default so that a change of default is a change to this file.
       - name: Initialise the analysis
-        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           languages: rust
           build-mode: none
@@ -111,7 +111,7 @@ jobs:
       # So the condition below excludes the fork and nothing else. What the fork
       # half rests on is not measured here and stays a claim.
       - name: Analyse
-        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           output: ${{ env.SARIF_DIR }}
           upload: never
@@ -141,7 +141,7 @@ jobs:
       # a verdict that was already made, and hides no finding.
       - name: Upload the findings to the code-scanning tab
         if: always() && ((github.event_name == 'push' && github.ref == 'refs/heads/main') || github.event.pull_request.head.repo.full_name == github.repository)
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: ${{ env.SARIF_DIR }}/rust.sarif
           category: /language:rust
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index c478ddc..7255df0 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -97,7 +97,7 @@ jobs:
 
       # Surface the findings in the code-scanning tab, alongside CodeQL and zizmor.
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: results.sarif
           category: scorecard
diff --git a/.github/workflows/shared-hygiene.yml b/.github/workflows/shared-hygiene.yml
index d8f0ad8..c1f4913 100644
--- a/.github/workflows/shared-hygiene.yml
+++ b/.github/workflows/shared-hygiene.yml
@@ -47,6 +47,6 @@ permissions:
 
 jobs:
   hygiene:
-    uses: iderex/wache/.github/workflows/pr-hygiene.yml@113085b269d3437a3f96ff9e7060b64b0af88ab1 # v1.2.0
+    uses: iderex/wache/.github/workflows/pr-hygiene.yml@4d91113f744527d4dd6397bb09fb276ef18b09fc # v1.3.0
     with:
       subject_names_issue: false
diff --git a/.github/workflows/shell-analysis.yml b/.github/workflows/shell-analysis.yml
index 0297be3..05b1b58 100644
--- a/.github/workflows/shell-analysis.yml
+++ b/.github/workflows/shell-analysis.yml
@@ -103,7 +103,7 @@ jobs:
       # finding.
       - name: Upload the findings to the code-scanning tab
         if: always() && ((github.event_name == 'push' && github.ref == 'refs/heads/main') || github.event.pull_request.head.repo.full_name == github.repository)
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: ${{ env.SARIF }}
           category: shellcheck
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 264234a..e32434d 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -89,7 +89,7 @@ jobs:
         # skip the "Fail on actionable findings" step below.
         if: (github.event_name == 'push' && github.ref == 'refs/heads/main') || (github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.user.login != 'dependabot[bot]')
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: results.sarif
           category: zizmor