diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 0744d852a..b1c016313 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -47,15 +47,15 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
         with:
           languages: python
           queries: security-extended
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4
+        uses: github/codeql-action/autobuild@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
         with:
           category: "/language:python"
diff --git a/.github/workflows/conventional-commit.yml b/.github/workflows/conventional-commit.yml
index ba30e7ee2..9392d7466 100644
--- a/.github/workflows/conventional-commit.yml
+++ b/.github/workflows/conventional-commit.yml
@@ -35,4 +35,4 @@ concurrency:
 
 jobs:
   conventional-commit:
-    uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_semantic_pull_request.yml@fe0ff3bbe10790c51273ee3c1189b3c0497bf860 # v1.8.5
+    uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_semantic_pull_request.yml@affd689912d7975a1aa29ea60c1b983f12dfb7e7 # v1.8.9
diff --git a/.github/workflows/secrets-detector.yml b/.github/workflows/secrets-detector.yml
index 2562b41fc..33824f213 100644
--- a/.github/workflows/secrets-detector.yml
+++ b/.github/workflows/secrets-detector.yml
@@ -30,4 +30,4 @@ concurrency:
 
 jobs:
   secrets-detector:
-    uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_secrets-detector.yml@fe0ff3bbe10790c51273ee3c1189b3c0497bf860 # v1.8.5
+    uses: NVIDIA-NeMo/FW-CI-templates/.github/workflows/_secrets-detector.yml@affd689912d7975a1aa29ea60c1b983f12dfb7e7 # v1.8.9