diff --git a/.github/workflows/release-drafter.yml b/.github/workflows/release-drafter.yml
index f659a7c7..1ec379e6 100644
--- a/.github/workflows/release-drafter.yml
+++ b/.github/workflows/release-drafter.yml
@@ -14,7 +14,7 @@ jobs:
       contents: write
       pull-requests: write
     steps:
-      - uses: release-drafter/release-drafter@34d80673e067bdc0c24568d3af899c216adcfaa9 # v7.7.0
+      - uses: release-drafter/release-drafter@c345907820e0396f6f44bcfd9ac4763325f8feb0 # v7.8.0
         with:
           config-name: release-drafter.yaml
         env:
diff --git a/.github/workflows/release-sandbox.yaml b/.github/workflows/release-sandbox.yaml
index 983963e1..42acc2fb 100644
--- a/.github/workflows/release-sandbox.yaml
+++ b/.github/workflows/release-sandbox.yaml
@@ -28,9 +28,9 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
       # https://github.com/actions/setup-go
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 09cca31c..794e0d04 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -30,9 +30,9 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
       # https://github.com/actions/setup-go
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
diff --git a/.github/workflows/typos.yaml b/.github/workflows/typos.yaml
index 3e978209..9deee040 100644
--- a/.github/workflows/typos.yaml
+++ b/.github/workflows/typos.yaml
@@ -13,4 +13,4 @@ jobs:
         with:
           persist-credentials: false
       - name: Check spelling of file.txt
-        uses: crate-ci/typos@8a48f81b6c64dcfea44b3633223084c4be58ac5f # v1.49.0
+        uses: crate-ci/typos@00f422f3b19c57bc6338715ebfe3316d38768461 # v1.50.3
diff --git a/.github/workflows/updatecli.yaml b/.github/workflows/updatecli.yaml
index 4fafb144..975d6eb5 100644
--- a/.github/workflows/updatecli.yaml
+++ b/.github/workflows/updatecli.yaml
@@ -16,7 +16,7 @@ jobs:
         with:
           persist-credentials: false
       - name: "Setup updatecli"
-        uses: "updatecli/updatecli-action@ca8c01bf875e2520512c344a71dd02f3dc3326a7" # v3.7.0
+        uses: "updatecli/updatecli-action@2efa15cbae1751f532f9bfc88f56adafd6d1faed" # v3.8.0
         with:
           version: "v0.121.0"
       - name: "Set up Go"
diff --git a/.github/workflows/updatecli_test.yaml b/.github/workflows/updatecli_test.yaml
index 302556c6..10333696 100644
--- a/.github/workflows/updatecli_test.yaml
+++ b/.github/workflows/updatecli_test.yaml
@@ -13,7 +13,7 @@ jobs:
         with:
           persist-credentials: false
       - name: "Setup updatecli"
-        uses: "updatecli/updatecli-action@ca8c01bf875e2520512c344a71dd02f3dc3326a7" # v3.7.0
+        uses: "updatecli/updatecli-action@2efa15cbae1751f532f9bfc88f56adafd6d1faed" # v3.8.0
         with:
           version: "v0.121.0"
       - name: "Set up Go"
diff --git a/.github/workflows/updatecli_update.yaml b/.github/workflows/updatecli_update.yaml
index e0117173..39ab307c 100644
--- a/.github/workflows/updatecli_update.yaml
+++ b/.github/workflows/updatecli_update.yaml
@@ -18,7 +18,7 @@ jobs:
         with:
           persist-credentials: false
       - name: "Setup updatecli"
-        uses: "updatecli/updatecli-action@ca8c01bf875e2520512c344a71dd02f3dc3326a7" # v3.7.0
+        uses: "updatecli/updatecli-action@2efa15cbae1751f532f9bfc88f56adafd6d1faed" # v3.8.0
         with:
           version: "v0.121.0"
       - name: "Set up Go"
diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml
index 872129a2..a35b633b 100644
--- a/.github/workflows/zizmor.yaml
+++ b/.github/workflows/zizmor.yaml
@@ -16,7 +16,7 @@ jobs:
         with:
           persist-credentials: false
       - name: "Run zizmor \U0001F308"
-        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
         with:
           # intentionally not scanning the entire repository,
           inputs: ./.github/