diff --git a/.github/workflows/call-github2gerrit.yaml b/.github/workflows/call-github2gerrit.yaml
index 25945fc6d87..fc5657608fc 100644
--- a/.github/workflows/call-github2gerrit.yaml
+++ b/.github/workflows/call-github2gerrit.yaml
@@ -33,7 +33,7 @@ jobs:
     steps:
       - name: Convert GitHub PR to Gerrit Change
         # yamllint disable-line rule:line-length
-        uses: lfreleng-actions/github2gerrit-action@3d548cc0cd8e04175da73a7dc3449b312ce67e07 # v2.1.0
+        uses: lfreleng-actions/github2gerrit-action@bbf43f32caf0cd678036e0bad4bb9d9b6e3fcab9 # v2.1.1
         with:
           GERRIT_SSH_PRIVKEY_G2G: ${{ secrets.GERRIT_SSH_PRIVKEY_G2G }}
           GERRIT_KNOWN_HOSTS: ${{ vars.GERRIT_KNOWN_HOSTS }}
diff --git a/.github/workflows/gerrit-sonar.yaml b/.github/workflows/gerrit-sonar.yaml
index 1dbe6861455..e1622713308 100644
--- a/.github/workflows/gerrit-sonar.yaml
+++ b/.github/workflows/gerrit-sonar.yaml
@@ -60,7 +60,7 @@ jobs:
     permissions:
       contents: read
     # yamllint disable-line rule:line-length
-    uses: lfreleng-actions/security-workflows/.github/workflows/sonarqube-cloud.yaml@ce587eb52066f14d9468d833428fa1219545fa1d # v0.5.2
+    uses: lfreleng-actions/security-workflows/.github/workflows/sonarqube-cloud.yaml@0dd3d5f05930b3c782a67f7735fd0133c0fa51d9 # v0.6.1
     with:
       # Gerrit dispatches carry a refspec and check out the change;
       # the weekly schedule leaves it empty and takes the branch.