diff --git a/.github/workflows/check-suite-monitor.yml b/.github/workflows/check-suite-monitor.yml
index 97291dffe..f20b8d041 100644
--- a/.github/workflows/check-suite-monitor.yml
+++ b/.github/workflows/check-suite-monitor.yml
@@ -123,7 +123,7 @@ jobs:
 
       - name: Alert on Critical Failures
         if: steps.analyze.outputs.severity == 'high'
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const checkSuiteId = '${{ steps.check-suite.outputs.check_suite_id }}';
diff --git a/.github/workflows/codeql-reusable.yml b/.github/workflows/codeql-reusable.yml
index 0e117acc3..48eb17abe 100644
--- a/.github/workflows/codeql-reusable.yml
+++ b/.github/workflows/codeql-reusable.yml
@@ -91,12 +91,12 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v3
+        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v3
         with:
           languages: ${{ inputs.language }}
           build-mode: ${{ inputs.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v3
+        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v3
         with:
           category: "/language:${{ inputs.language }}"
diff --git a/.github/workflows/hypatia-scan-reusable.yml b/.github/workflows/hypatia-scan-reusable.yml
index 3a70113d6..35983b659 100644
--- a/.github/workflows/hypatia-scan-reusable.yml
+++ b/.github/workflows/hypatia-scan-reusable.yml
@@ -223,7 +223,7 @@ jobs:
         # This flag only tolerates a genuine upload failure (e.g. Advanced
         # Security disabled on a private repo) once the job is actually running.
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v3
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v3
         with:
           sarif_file: hypatia.sarif
           category: hypatia
diff --git a/.github/workflows/scorecard-reusable.yml b/.github/workflows/scorecard-reusable.yml
index 8750b94ac..2e61ae0cd 100644
--- a/.github/workflows/scorecard-reusable.yml
+++ b/.github/workflows/scorecard-reusable.yml
@@ -46,7 +46,7 @@ jobs:
       # alerts were stuck at 2026-06-03 while Hypatia's updated 2026-08-24.
       # The badge kept working, which is why it went unnoticed.
       - name: Upload SARIF to code scanning
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v3
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v3
         with:
           sarif_file: results.sarif
 
@@ -127,7 +127,7 @@ jobs:
           n=$(jq '[.runs[].automationDetails.id | split("/")[0:2] | join("/")] | unique | length' results.sarif)
           test "$n" -eq 3 || { echo "expected 3 Scorecard categories, got $n" >&2; exit 1; }
       - name: Upload SARIF to code scanning
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         with:
           sarif_file: results.sarif
       - name: Retain scan evidence
diff --git a/.github/workflows/security-gate-pr-target.yml b/.github/workflows/security-gate-pr-target.yml
index 4482b13ed..4aea11eda 100644
--- a/.github/workflows/security-gate-pr-target.yml
+++ b/.github/workflows/security-gate-pr-target.yml
@@ -155,7 +155,7 @@ jobs:
 
       - name: Post Security Scan Comment
         if: steps.fork-check.outputs.is_fork == 'true'
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const prNumber = context.issue.number;