diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 3127970..d3f31a2 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -78,7 +78,7 @@ jobs:
       # runner drops an output it takes for a secret, and the plan carries
       # free text such as test commands.
       - name: Upload plan
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: plan
           path: ${{ runner.temp }}/plan.json
@@ -118,7 +118,7 @@ jobs:
           path: src
           persist-credentials: false
       - name: Download plan
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: plan
           path: ${{ runner.temp }}
@@ -144,7 +144,7 @@ jobs:
         run: rc test-image --plan "$RUNNER_TEMP/plan.json" --target default --distro "$DISTRO" --work-dir "$RUNNER_TEMP/tests"
       - name: Log in to GitHub Container Registry
         if: env.PUBLISH == 'true'
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -159,7 +159,7 @@ jobs:
             --output-dir "$RUNNER_TEMP/digests"
       - name: Upload digests
         if: env.PUBLISH == 'true'
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: digests-${{ matrix.distro }}-${{ matrix.arch }}
           path: ${{ runner.temp }}/digests/*
@@ -197,18 +197,18 @@ jobs:
       - name: Set up rc
         uses: ./.rc/setup-rc
       - name: Download plan
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: plan
           path: ${{ runner.temp }}
       - name: Download digests
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: digests-${{ matrix.distro }}-*
           merge-multiple: true
           path: ${{ runner.temp }}/digests
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -261,7 +261,7 @@ jobs:
       - name: Set up rc
         uses: ./.rc/setup-rc
       - name: Download plan
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: plan
           path: ${{ runner.temp }}
@@ -315,7 +315,7 @@ jobs:
       matrix: ${{ fromJSON(needs.plan.outputs.merge-matrix) }}
     steps:
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -331,7 +331,7 @@ jobs:
       - name: Upload results
         if: steps.grype.outputs.sarif != ''
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           sarif_file: ${{ steps.grype.outputs.sarif }}
           category: grype-${{ matrix.flavour }}-${{ matrix.distro }}
diff --git a/.github/workflows/reconcile.yml b/.github/workflows/reconcile.yml
index 64907ab..412f8aa 100644
--- a/.github/workflows/reconcile.yml
+++ b/.github/workflows/reconcile.yml
@@ -47,7 +47,7 @@ jobs:
           uv --version
       - name: Create token for reading and dispatching
         id: dispatch-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           client-id: ${{ vars.RC_APP_CLIENT_ID || secrets.RC_APP_CLIENT_ID }}
           private-key: ${{ secrets.RC_APP_PRIVATE_KEY }}
@@ -64,7 +64,7 @@ jobs:
           --commit-file "$RUNNER_TEMP/commits.json" --setup-file "$RUNNER_TEMP/setup.json"
       - name: Upload status
         if: ${{ !cancelled() && steps.reconcile.outputs.written == 'true' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: status
           path: ${{ runner.temp }}/status/
@@ -77,7 +77,7 @@ jobs:
       - name: Create token for commits
         id: write-token
         if: ${{ steps.reconcile.outputs.commits == 'true' }}
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           client-id: ${{ vars.RC_APP_CLIENT_ID || secrets.RC_APP_CLIENT_ID }}
           private-key: ${{ secrets.RC_APP_PRIVATE_KEY }}
@@ -96,7 +96,7 @@ jobs:
       - name: Create token for repository setup
         id: admin-token
         if: ${{ steps.reconcile.outputs.setup == 'true' }}
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           client-id: ${{ vars.RC_APP_CLIENT_ID || secrets.RC_APP_CLIENT_ID }}
           private-key: ${{ secrets.RC_APP_PRIVATE_KEY }}
@@ -122,7 +122,7 @@ jobs:
       REPO: ${{ github.repository }}
     steps:
       - name: Download status
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: status
           path: ${{ runner.temp }}/status
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 086cde0..4a7a1ba 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -106,7 +106,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
         with:
           # The combo template is checked with this repository's config, which
           # has the same pin policy as src/rc/templates/combo/zizmor.yml.