diff --git a/.github/actions/setup-java-env/action.yaml b/.github/actions/setup-java-env/action.yaml
index 0cde1e2..a611be6 100644
--- a/.github/actions/setup-java-env/action.yaml
+++ b/.github/actions/setup-java-env/action.yaml
@@ -31,7 +31,7 @@ runs:
         distribution: "temurin"
         java-version: "${{ inputs.runtime_version }}"
     - name: "gradle / validate wrapper"
-      uses: "gradle/actions/wrapper-validation@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2" # v5.0.0
+      uses: "gradle/actions/wrapper-validation@0723195856401067f7a2779048b490ace7a47d7c" # v5.0.2
     # Checks branch name to see if we're going to potentially publish this
     - name: "publishing branch"
       uses: "KyoriPowered/action-regex-match@5684ded1f3e016437483d3d74cfa93fcdf5e313b" # v5.0.0
@@ -46,6 +46,6 @@ runs:
       run: |
         exec "$GITHUB_ACTION_PATH/setup-gradle-properties.sh"
     - name: "gradle / setup environment"
-      uses: "gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2" # v5.0.0
+      uses: "gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c" # v5.0.2
       with:
         cache-read-only: "${{ steps.branch-name.outputs.match == '' || github.event_name == 'pull_request' }}"
diff --git a/.github/workflows/shared-codeql-analysis.yaml b/.github/workflows/shared-codeql-analysis.yaml
index 0cd6b04..56232c3 100644
--- a/.github/workflows/shared-codeql-analysis.yaml
+++ b/.github/workflows/shared-codeql-analysis.yaml
@@ -35,10 +35,10 @@ jobs:
         publishing_branch_regex: ${{ inputs.publishing_branch_regex }}
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@19b2f06db2b6f5108140aeb04014ef02b648f789 # v4
+      uses: github/codeql-action/init@0d579ffd059c29b07949a3cce3983f0780820c98 # v4
       with:
         languages: java
     - name: Build with Gradle
       run: ./gradlew ${{ inputs.extra_gradle_params }} assemble
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@19b2f06db2b6f5108140aeb04014ef02b648f789 # v4
+      uses: github/codeql-action/analyze@0d579ffd059c29b07949a3cce3983f0780820c98 # v4
diff --git a/.github/workflows/validate-renovate-config.yaml b/.github/workflows/validate-renovate-config.yaml
index 12d3972..7481a84 100644
--- a/.github/workflows/validate-renovate-config.yaml
+++ b/.github/workflows/validate-renovate-config.yaml
@@ -15,6 +15,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-    - uses: suzuki-shunsuke/github-action-renovate-config-validator@ca480cb7ec89a9e1cd8c214ad33bda1617184027 # v2.0.0
+    - uses: suzuki-shunsuke/github-action-renovate-config-validator@ee9f69e1f683ed0d08225086482b34fc9abe9300 # v2.1.0
       with:
         config_file_path: renovate-config.json