diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1506ca5..6120300 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -41,7 +41,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
 
       - name: Set up ccache
-        uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639
+        uses: hendrikmuhs/ccache-action@1bbbcda0748b3e340dee71a314fa68ffcbd6df79
         with:
           key: ${{ inputs.os }}-${{ inputs.compiler }}-${{ inputs.build-config }}-${{ matrix.qt-version }}
           restore-keys: |
@@ -50,7 +50,7 @@ jobs:
             ${{ inputs.os }}
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@9e907b5e64f6b83e7804b09294d44122997950d6
+        uses: github/codeql-action/init@b1bff81932f5cdfc8695c7752dcee935dcd061c8
         with:
           languages: cpp
           queries: security-and-quality
@@ -149,25 +149,25 @@ jobs:
         shell: bash
 
       - name: Generate SBOM
-        uses: anchore/sbom-action@28d71544de8eaf1b958d335707167c5f783590ad
+        uses: anchore/sbom-action@57aae528053a48a3f6235f2d9461b05fbcb7366d
         with:
           output-file: build/${{ inputs.build-config }}/dist/EFIBootEditor-${{ github.sha }}-${{ inputs.os }}-qt-${{ matrix.qt-version }}.spdx
           upload-artifact: false
           upload-release-assets: false
 
       - name: Attest artifacts
-        uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32
         with:
           subject-path: build/${{ inputs.build-config }}/dist/EFIBootEditor-*
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f
         with:
           name: EFIBootEditor-${{ github.sha }}-${{ inputs.os }}-qt-${{ matrix.qt-version }}-${{ inputs.compiler }}
           if-no-files-found: error
           path: build/${{ inputs.build-config }}/dist/EFIBootEditor-*
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@9e907b5e64f6b83e7804b09294d44122997950d6
+        uses: github/codeql-action/analyze@b1bff81932f5cdfc8695c7752dcee935dcd061c8
         if: inputs.build-config == 'Debug'
         continue-on-error: true
diff --git a/.github/workflows/draft_release.yml b/.github/workflows/draft_release.yml
index bf87131..345aa54 100644
--- a/.github/workflows/draft_release.yml
+++ b/.github/workflows/draft_release.yml
@@ -11,6 +11,6 @@ jobs:
       contents: write
       pull-requests: read
     steps:
-      - uses: release-drafter/release-drafter@6db134d15f3909ccc9eefd369f02bd1e9cffdf97
+      - uses: release-drafter/release-drafter@139054aeaa9adc52ab36ddf67437541f039b88e2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml
index bbaa7d0..e041784 100644
--- a/.github/workflows/format.yml
+++ b/.github/workflows/format.yml
@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-slim
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
-      - uses: cpp-linter/cpp-linter-action@b6edc0625e3941baa1797f4b4326adeab6890c97
+      - uses: cpp-linter/cpp-linter-action@24467985494bed9bfc398489b6ec12469beaf4da
         id: linter
         with:
           version: 21
diff --git a/.github/workflows/qt_update.yml b/.github/workflows/qt_update.yml
index bf61b9e..49c7fb3 100644
--- a/.github/workflows/qt_update.yml
+++ b/.github/workflows/qt_update.yml
@@ -35,7 +35,7 @@ jobs:
           repository: EFIBootEditorBot/efibooteditor
 
       - name: Install uv
-        uses: astral-sh/setup-uv@eac588ad8def6316056a12d4907a9d4d84ff7a3b
+        uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78
         with:
           enable-cache: true
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0bc789d..ed870ee 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -107,7 +107,7 @@ jobs:
 
     steps:
       - name: Download all artifacts
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
         with:
           path: artifacts
 
@@ -129,12 +129,12 @@ jobs:
         shell: bash
 
       - name: Attest release assets
-        uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32
         with:
           subject-path: dist/EFIBootEditor-*
 
       - name: Upload assets to release
-        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b
+        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe
         with:
           files: dist/EFIBootEditor-*
           tag_name: ${{ github.ref_name }}