diff --git a/.github/workflows/compose-notify.yml b/.github/workflows/compose-notify.yml
index 9b76e79..7e9d732 100644
--- a/.github/workflows/compose-notify.yml
+++ b/.github/workflows/compose-notify.yml
@@ -48,13 +48,13 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Configure 1Password Service Account
-        uses: 1password/load-secrets-action/configure@3a12b0ab99d9cd590a3e9b5a90ea017210ed9556  # v4.0.1
+        uses: 1password/load-secrets-action/configure@eb2efd0703da22a93c467f2d1ffbb6826c11e19c  # v4.1.1
         with:
           service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
 
       - name: Load Discord webhook and user ID
         id: op-load-discord
-        uses: 1password/load-secrets-action@3a12b0ab99d9cd590a3e9b5a90ea017210ed9556  # v4.0.1
+        uses: 1password/load-secrets-action@eb2efd0703da22a93c467f2d1ffbb6826c11e19c  # v4.1.1
         with:
           unset-previous: true
         env:
@@ -124,6 +124,6 @@ jobs:
           avatar_url: "https://cdn-icons-png.flaticon.com/512/2103/2103633.png"
 
       - name: Unload Discord webhook
-        uses: 1password/load-secrets-action@3a12b0ab99d9cd590a3e9b5a90ea017210ed9556  # v4.0.1
+        uses: 1password/load-secrets-action@eb2efd0703da22a93c467f2d1ffbb6826c11e19c  # v4.1.1
         with:
           unset-previous: true
diff --git a/.github/workflows/compose-security.yml b/.github/workflows/compose-security.yml
index 9e6badd..fe2dd27 100644
--- a/.github/workflows/compose-security.yml
+++ b/.github/workflows/compose-security.yml
@@ -96,14 +96,14 @@ jobs:
       # --- GitGuardian (push events only) ---------------------------------
       - name: Configure 1Password Service Account
         if: inputs.event-name == 'push'
-        uses: 1password/load-secrets-action/configure@3a12b0ab99d9cd590a3e9b5a90ea017210ed9556  # v4.0.1
+        uses: 1password/load-secrets-action/configure@eb2efd0703da22a93c467f2d1ffbb6826c11e19c  # v4.1.1
         with:
           service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
 
       - name: Load GitGuardian credentials
         id: op-load-secret
         if: inputs.event-name == 'push'
-        uses: 1password/load-secrets-action@3a12b0ab99d9cd590a3e9b5a90ea017210ed9556  # v4.0.1
+        uses: 1password/load-secrets-action@eb2efd0703da22a93c467f2d1ffbb6826c11e19c  # v4.1.1
         with:
           unset-previous: true
         env:
@@ -123,7 +123,7 @@ jobs:
 
       - name: Unload GitGuardian credentials
         if: always() && inputs.event-name == 'push'
-        uses: 1password/load-secrets-action@3a12b0ab99d9cd590a3e9b5a90ea017210ed9556  # v4.0.1
+        uses: 1password/load-secrets-action@eb2efd0703da22a93c467f2d1ffbb6826c11e19c  # v4.1.1
         with:
           unset-previous: true
 
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 929bd7c..2a85eca 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -281,14 +281,14 @@ jobs:
 
       - name: Configure 1Password Service Account
         if: steps.skip-gate.outputs.skipped == 'false'
-        uses: 1password/load-secrets-action/configure@3a12b0ab99d9cd590a3e9b5a90ea017210ed9556  # v4.0.1
+        uses: 1password/load-secrets-action/configure@eb2efd0703da22a93c467f2d1ffbb6826c11e19c  # v4.1.1
         with:
           service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
 
       - name: Load registry credentials
         id: creds
         if: steps.skip-gate.outputs.skipped == 'false'
-        uses: 1password/load-secrets-action@3a12b0ab99d9cd590a3e9b5a90ea017210ed9556  # v4.0.1
+        uses: 1password/load-secrets-action@eb2efd0703da22a93c467f2d1ffbb6826c11e19c  # v4.1.1
         with:
           unset-previous: true
         env:
@@ -307,7 +307,7 @@ jobs:
       # logout: false leaves the cached creds in place for downstream steps.
       - name: Login to ghcr.io
         if: steps.skip-gate.outputs.skipped == 'false'
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7  # v4.5.1
         continue-on-error: true
         with:
           registry: ghcr.io
@@ -317,7 +317,7 @@ jobs:
 
       - name: Login to docker.io
         if: steps.skip-gate.outputs.skipped == 'false'
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7  # v4.5.1
         continue-on-error: true
         with:
           username: ${{ steps.creds.outputs.DOCKERHUB_USERNAME }}
@@ -326,7 +326,7 @@ jobs:
 
       - name: Login to registry.gitlab.com
         if: steps.skip-gate.outputs.skipped == 'false'
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7  # v4.5.1
         continue-on-error: true
         with:
           registry: registry.gitlab.com
@@ -336,7 +336,7 @@ jobs:
 
       - name: Login to gitlab-container.zenterprise.org
         if: steps.skip-gate.outputs.skipped == 'false'
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0  # v4.4.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7  # v4.5.1
         continue-on-error: true
         with:
           registry: gitlab-container.zenterprise.org
@@ -771,7 +771,7 @@ jobs:
           sparse-checkout-cone-mode: false
 
       - name: Configure 1Password Service Account
-        uses: 1password/load-secrets-action/configure@3a12b0ab99d9cd590a3e9b5a90ea017210ed9556  # v4.0.1
+        uses: 1password/load-secrets-action/configure@eb2efd0703da22a93c467f2d1ffbb6826c11e19c  # v4.1.1
         with:
           service-account-token: ${{ secrets.OP_SERVICE_ACCOUNT_TOKEN }}
 
@@ -940,7 +940,7 @@ jobs:
 
       - name: Load Discord webhook and user ID
         id: op-load-discord
-        uses: 1password/load-secrets-action@3a12b0ab99d9cd590a3e9b5a90ea017210ed9556  # v4.0.1
+        uses: 1password/load-secrets-action@eb2efd0703da22a93c467f2d1ffbb6826c11e19c  # v4.1.1
         with:
           unset-previous: true
         env:
@@ -1039,6 +1039,6 @@ jobs:
           fi
 
       - name: Unload Discord webhook
-        uses: 1password/load-secrets-action@3a12b0ab99d9cd590a3e9b5a90ea017210ed9556  # v4.0.1
+        uses: 1password/load-secrets-action@eb2efd0703da22a93c467f2d1ffbb6826c11e19c  # v4.1.1
         with:
           unset-previous: true