diff --git a/.github/workflows/logging-checks.yml b/.github/workflows/logging-checks.yml
index 132ed6d..2c61173 100644
--- a/.github/workflows/logging-checks.yml
+++ b/.github/workflows/logging-checks.yml
@@ -21,7 +21,7 @@ jobs:
         with:
           version: v4.3.0
       - name: Setup Python
-        uses: actions/setup-python@06da6279cdbca41027908073e81a4544dc79c06b
+        uses: actions/setup-python@ff73b2463e2f3baa703f830da214b8dfeeaeccf8
         with:
           python-version: "3.12"
       - name: Render charts, extract inputs, registered watch
diff --git a/.github/workflows/rotate-opencode-openai.yml b/.github/workflows/rotate-opencode-openai.yml
index 3da0fcd..ebe5f73 100644
--- a/.github/workflows/rotate-opencode-openai.yml
+++ b/.github/workflows/rotate-opencode-openai.yml
@@ -49,7 +49,7 @@ jobs:
 
       - name: Create scoped GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           app-id: "4745727"
           private-key: ${{ secrets.CHART_UPDATER_GITHUB_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 24c4ea8..fad323b 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -24,7 +24,7 @@ jobs:
         # became unresolvable to runners on 2026-09-09 across regions and
         # retries while the API tag cache still served it; upstream rewrote
         # the tagged commit. Re-pinned to a branch-reachable commit.
-        uses: actions/setup-python@06da6279cdbca41027908073e81a4544dc79c06b
+        uses: actions/setup-python@ff73b2463e2f3baa703f830da214b8dfeeaeccf8
         with:
           python-version: "3.12"