diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index adaaafd2..db9c0e22 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -203,7 +203,7 @@ jobs:
 
       - name: Create Homebrew tap app token
         id: create_tap_token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510
         with:
           client-id: ${{ env.HOMEBREW_TAP_APP_CLIENT_ID }}
           private-key: ${{ env.HOMEBREW_TAP_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fef1a00f..b361b075 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -29,7 +29,7 @@ jobs:
     steps:
       - name: Generate app token
         id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510
         with:
           # v3 requires the GitHub App client ID.
           client-id: ${{ secrets.APP_CLIENT_ID }}
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index fcd211e3..f51ed43c 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -60,7 +60,7 @@ jobs:
 
       - name: Secret scan
         # Scan only PR diff range to reduce noise and speed up checks.
-        uses: trufflesecurity/trufflehog@363923b901c911a9164f50b6c423f47c15372b1c
+        uses: trufflesecurity/trufflehog@e76dff8a7e57d6df0c60ad8cbf5d5cba505a8fc9
         with:
           path: ./
           base: ${{ github.event.pull_request.base.sha }}