diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 31817c963..698122a7d 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -48,13 +48,13 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
         with:
           languages: python
           # Erweiterte Security+Quality Queries (findet mehr als das Default-Set)
           queries: security-and-quality
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
         with:
           category: "/language:python"
diff --git a/.github/workflows/update_combined_blacklist.yml b/.github/workflows/update_combined_blacklist.yml
index 18eca1127..2e99e67a0 100644
--- a/.github/workflows/update_combined_blacklist.yml
+++ b/.github/workflows/update_combined_blacklist.yml
@@ -103,7 +103,7 @@ jobs:
 
       - name: Restore seen_db Cache
         if: steps.idempotency.outputs.already_ran != 'true'
-        uses: actions/cache/restore@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: seen_db.json
           key: netshield-seen-db-v2-${{ github.run_id }}
@@ -2381,7 +2381,7 @@ jobs:
         # wenn Idempotenz-Guard nicht geskippt hat. Beim Skip soll auch der Cache-
         # Save nicht laufen, da kein Build-Step ausgefuehrt wurde.
         if: always() && steps.idempotency.outputs.already_ran != 'true'
-        uses: actions/cache/save@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: seen_db.json
           # v2: Kein statischer "latest"-Key mehr. Restore erfolgt über Prefix