diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3865fe7683..de1bc67c38 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -272,7 +272,7 @@ jobs:
           echo "GOCACHE=${{ github.workspace }}/.gocache" >> $GITHUB_ENV
 
       - name: Create/Update Draft
-        uses: lucacome/draft-release@45e4395a3d8463abdb1747b20445b9be16ef6409 # v2.0.1
+        uses: lucacome/draft-release@0ebb400b90474a1b791602046abf8394e9f5402d # v2.0.2
         with:
           minor-label: "enhancement"
           major-label: "change"
diff --git a/.github/workflows/helm.yml b/.github/workflows/helm.yml
index d929920c1d..740f04570d 100644
--- a/.github/workflows/helm.yml
+++ b/.github/workflows/helm.yml
@@ -113,7 +113,7 @@ jobs:
           kubectl create secret generic nplus-license --from-file license.jwt -n nginx-gateway
 
       - name: Set up Python
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
         with:
           python-version: "3.x"
           check-latest: true
@@ -166,7 +166,7 @@ jobs:
           kubectl create secret generic nplus-license --from-file license.jwt -n nginx-gateway
 
       - name: Set up Python
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
         with:
           python-version: "3.x"
           check-latest: true
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 2e0c38aebe..68a405b612 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -116,7 +116,7 @@ jobs:
           fetch-depth: 0
 
       - name: Set up Python
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
         with:
           python-version: "3.x"
           check-latest: true
diff --git a/.github/workflows/release-pr.yml b/.github/workflows/release-pr.yml
index b388c8b3f4..8e891c91c9 100644
--- a/.github/workflows/release-pr.yml
+++ b/.github/workflows/release-pr.yml
@@ -36,7 +36,7 @@ jobs:
 
       - name: Get Release Notes
         id: notes
-        uses: lucacome/draft-release@45e4395a3d8463abdb1747b20445b9be16ef6409 # v2.0.1
+        uses: lucacome/draft-release@0ebb400b90474a1b791602046abf8394e9f5402d # v2.0.2
         with:
           config-path: .github/release-notes.yml
           dry-run: true
diff --git a/.github/workflows/update-docker-images.yml b/.github/workflows/update-docker-images.yml
index 6ccae1db4e..91b62b3762 100644
--- a/.github/workflows/update-docker-images.yml
+++ b/.github/workflows/update-docker-images.yml
@@ -67,7 +67,7 @@ jobs:
 
       - name: Check if update available for nginx image
         id: update
-        uses: lucacome/docker-image-update-checker@5d84572804be8bd4dc353f08c8437efdb6af37ac # v3.0.0
+        uses: lucacome/docker-image-update-checker@03e3f8ff4b69a3bf845e2f6b56f0e0b0ad7e1d1e # v3.0.1
         with:
           base-image: ${{ needs.variables.outputs.nginx_version }}
           image: ghcr.io/nginx/nginx-gateway-fabric/nginx:${{ needs.variables.outputs.ngf_tag }}