diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7acefa2dc..e3a15802d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -56,7 +56,7 @@ jobs:
           json: ${{ secrets.SNOWFLAKE_GH_CI_PKEY }}
           dir: "nexus/server/tests/assets/"
 
-      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
         with:
           workspaces: nexus
 
diff --git a/.github/workflows/cleanup.yml b/.github/workflows/cleanup.yml
index 40c013f61..9015970d0 100644
--- a/.github/workflows/cleanup.yml
+++ b/.github/workflows/cleanup.yml
@@ -14,7 +14,7 @@ jobs:
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
-          go-version: '1.26.5'
+          go-version: '1.26.6'
           cache-dependency-path: e2e_cleanup/go.sum
 
       - name: download go modules
diff --git a/.github/workflows/customer-docker.yml b/.github/workflows/customer-docker.yml
index dd3214854..5775ffffa 100644
--- a/.github/workflows/customer-docker.yml
+++ b/.github/workflows/customer-docker.yml
@@ -26,7 +26,7 @@ jobs:
       - uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           registry: ghcr.io
           username: ${{github.actor}}
diff --git a/.github/workflows/dev-docker.yml b/.github/workflows/dev-docker.yml
index fe83ed112..19cad2d68 100644
--- a/.github/workflows/dev-docker.yml
+++ b/.github/workflows/dev-docker.yml
@@ -61,7 +61,7 @@ jobs:
       - uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           registry: ghcr.io
           username: ${{github.actor}}
diff --git a/.github/workflows/golang-lint.yml b/.github/workflows/golang-lint.yml
index 15b00bf5f..c3df637f0 100644
--- a/.github/workflows/golang-lint.yml
+++ b/.github/workflows/golang-lint.yml
@@ -24,7 +24,7 @@ jobs:
           sudo apt-get install libgeos-dev
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
-          go-version: '1.26.5'
+          go-version: '1.26.6'
           cache: false
       # flow/pkg's Ruleguard config imports flow/generated/protos, so lint needs
       # both modules in a workspace. e2e_cleanup is linted under it too.
diff --git a/.github/workflows/mysql-debug-docker.yml b/.github/workflows/mysql-debug-docker.yml
index 919e1d656..70ca70439 100644
--- a/.github/workflows/mysql-debug-docker.yml
+++ b/.github/workflows/mysql-debug-docker.yml
@@ -60,7 +60,7 @@ jobs:
       - uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
diff --git a/.github/workflows/release-drafter.yml b/.github/workflows/release-drafter.yml
index 03d2c9ded..32a7e6da2 100644
--- a/.github/workflows/release-drafter.yml
+++ b/.github/workflows/release-drafter.yml
@@ -15,4 +15,4 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - uses: release-drafter/release-drafter@eada3c96a64734dd381cfbda23511034e328ddb0 # v7
+      - uses: release-drafter/release-drafter@34d80673e067bdc0c24568d3af899c216adcfaa9 # v7
diff --git a/.github/workflows/stable-docker.yml b/.github/workflows/stable-docker.yml
index 01e0e1b89..268dd4b1f 100644
--- a/.github/workflows/stable-docker.yml
+++ b/.github/workflows/stable-docker.yml
@@ -23,7 +23,7 @@ jobs:
       - uses: depot/setup-action@15c09a5f77a0840ad4bce955686522a257853461 # v1
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           registry: ghcr.io
           username: ${{github.actor}}
diff --git a/.github/workflows/tilt-flow.yml b/.github/workflows/tilt-flow.yml
index 90ae34a4b..b8b79eaa9 100644
--- a/.github/workflows/tilt-flow.yml
+++ b/.github/workflows/tilt-flow.yml
@@ -207,7 +207,7 @@ jobs:
     runs-on: ubuntu-latest-16-cores
     timeout-minutes: 60
     steps:
-      - uses: Kesin11/actions-timeline@7bf79990b7c09f5dfb570ac30b814ca597bd538e # v3.1.1
+      - uses: Kesin11/actions-timeline@57fc93f20c6da7fbc14063c6d24a2a5627c799ad # v3.2.0
         with:
           expand-composite-actions: true
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
@@ -232,7 +232,7 @@ jobs:
 
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
-          go-version: '1.26.5'
+          go-version: '1.26.6'
           cache-dependency-path: |
             flow/go.sum
             flow/pkg/go.sum