diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3be77a9f..fc795ecf 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -472,7 +472,7 @@ jobs:
       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5  # v4
+      uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e  # v4
 
     - name: Set up Syft
       uses: ./.github/actions/setup-syft
diff --git a/.github/workflows/codex-review.yml b/.github/workflows/codex-review.yml
index 4fe6dc47..48e6f159 100644
--- a/.github/workflows/codex-review.yml
+++ b/.github/workflows/codex-review.yml
@@ -58,7 +58,7 @@ jobs:
 
     - name: Run Codex
       id: run_codex
-      uses: openai/codex-action@e0fdf01220eb9a88167c4898839d273e3f2609d1  # v1
+      uses: openai/codex-action@86365089eb2b84e0a8fb0717b304f8bdcb13b20e  # v1
       with:
         openai-api-key: ${{ secrets.OPENAI_API_KEY }}
         sandbox: read-only
diff --git a/.github/workflows/default-install-smoke.yml b/.github/workflows/default-install-smoke.yml
index e677f76e..13af807e 100644
--- a/.github/workflows/default-install-smoke.yml
+++ b/.github/workflows/default-install-smoke.yml
@@ -53,7 +53,7 @@ jobs:
           go-version-file: go.mod
 
       - name: Install kind
-        uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc  # v1
+        uses: helm/kind-action@06c1ae10762d3b9c1644e7fe69596ae519e015a2  # v1.15.0
         with:
           install_only: true
 
diff --git a/.github/workflows/release-sbom.yml b/.github/workflows/release-sbom.yml
index 1a734389..3f4e92cd 100644
--- a/.github/workflows/release-sbom.yml
+++ b/.github/workflows/release-sbom.yml
@@ -69,7 +69,7 @@ jobs:
         version: ${{ env.SYFT_VERSION }}
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5  # v4
+      uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e  # v4
 
     - name: Login to GitHub Container Registry
       uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9  # v3