diff --git a/.github/workflows/casket-ci.yml b/.github/workflows/casket-ci.yml
index 3b0876d..c4a6659 100644
--- a/.github/workflows/casket-ci.yml
+++ b/.github/workflows/casket-ci.yml
@@ -27,7 +27,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v7.0.1
       - name: Setup Haskell
-        uses: haskell-actions/setup@v2.12.0
+        uses: haskell-actions/setup@v2.12.1
         with:
           ghc-version: ${{ matrix.ghc }}
           enable-stack: true
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ad3b759..4626626 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,7 +18,7 @@ jobs:
       - name: Set up GHC
         # The visible release tag is resolved to an immutable commit by
         # actions.lock, and repository policy requires that locked SHA.
-        uses: haskell-actions/setup@v2.12.0
+        uses: haskell-actions/setup@v2.12.1
         with:
           ghc-version: '9.4'
           cabal-version: '3.10'
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 7f144c8..c7b4ebb 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -36,13 +36,13 @@ jobs:
         with:
           persist-credentials: false
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v3
+        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v3
         with:
           languages: ${{ matrix.language }}
           queries: +security-extended,security-and-quality
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v4.38.0
+        uses: github/codeql-action/autobuild@v4.38.2
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v3
+        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v3
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml
index a8b271d..79a268e 100644
--- a/.github/workflows/sbom.yml
+++ b/.github/workflows/sbom.yml
@@ -19,7 +19,7 @@ jobs:
       - name: Checkout code
         uses: actions/checkout@v7.0.1
       - name: Setup Haskell
-        uses: haskell-actions/setup@v2.12.0
+        uses: haskell-actions/setup@v2.12.1
         with:
           ghc-version: '9.6.6'
           enable-stack: true