diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 8db0d28..476920b 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -87,7 +87,7 @@ jobs:
       # rather than watching a compiler. Written here rather than left to a
       # default so that a change of default is a change to this file.
       - name: Initialise the analysis
-        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         with:
           languages: rust
           build-mode: none
@@ -111,7 +111,7 @@ jobs:
       # So the condition below excludes the fork and nothing else. What the fork
       # half rests on is not measured here and stays a claim.
       - name: Analyse
-        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         with:
           output: ${{ env.SARIF_DIR }}
           upload: never
@@ -141,7 +141,7 @@ jobs:
       # a verdict that was already made, and hides no finding.
       - name: Upload the findings to the code-scanning tab
         if: always() && ((github.event_name == 'push' && github.ref == 'refs/heads/main') || github.event.pull_request.head.repo.full_name == github.repository)
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         with:
           sarif_file: ${{ env.SARIF_DIR }}/rust.sarif
           category: /language:rust
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index c478ddc..faa0874 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -97,7 +97,7 @@ jobs:
 
       # Surface the findings in the code-scanning tab, alongside CodeQL and zizmor.
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         with:
           sarif_file: results.sarif
           category: scorecard
diff --git a/.github/workflows/shared-hygiene.yml b/.github/workflows/shared-hygiene.yml
index d8f0ad8..c1f4913 100644
--- a/.github/workflows/shared-hygiene.yml
+++ b/.github/workflows/shared-hygiene.yml
@@ -47,6 +47,6 @@ permissions:
 
 jobs:
   hygiene:
-    uses: iderex/wache/.github/workflows/pr-hygiene.yml@113085b269d3437a3f96ff9e7060b64b0af88ab1 # v1.2.0
+    uses: iderex/wache/.github/workflows/pr-hygiene.yml@4d91113f744527d4dd6397bb09fb276ef18b09fc # v1.3.0
     with:
       subject_names_issue: false
diff --git a/.github/workflows/shell-analysis.yml b/.github/workflows/shell-analysis.yml
index 0297be3..eae2150 100644
--- a/.github/workflows/shell-analysis.yml
+++ b/.github/workflows/shell-analysis.yml
@@ -103,7 +103,7 @@ jobs:
       # finding.
       - name: Upload the findings to the code-scanning tab
         if: always() && ((github.event_name == 'push' && github.ref == 'refs/heads/main') || github.event.pull_request.head.repo.full_name == github.repository)
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         with:
           sarif_file: ${{ env.SARIF }}
           category: shellcheck
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index c92b6f1..b32e076 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -109,7 +109,7 @@ jobs:
         # .github/workflows/shell-analysis.yml names at its own upload.
         if: (github.event_name == 'push' && github.ref == 'refs/heads/main') || github.event.pull_request.head.repo.full_name == github.repository
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         with:
           sarif_file: results.sarif
           category: zizmor