diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 11a6658..69f20a0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -140,7 +140,7 @@ jobs:
       # Production PyPI — only on a published Release. Trusted Publishing (OIDC).
       - name: Publish to PyPI
         if: github.event_name == 'release'
-        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
           packages-dir: dist/
           # No `password:` — OIDC Trusted Publishing is used (no stored secret).
@@ -152,7 +152,7 @@ jobs:
       # Requires a SEPARATE Trusted Publisher on test.pypi.org (optional; see RELEASING.md).
       - name: Publish to TestPyPI (manual dry run)
         if: github.event_name == 'workflow_dispatch' && github.event.inputs.publish-target == 'testpypi'
-        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1
+        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
         with:
           packages-dir: dist/
           repository-url: https://test.pypi.org/legacy/
@@ -191,7 +191,7 @@ jobs:
           path: dist/
 
       - name: Sign sdist + wheel and attach bundles to the Release
-        uses: sigstore/gh-action-sigstore-python@5b79a39c381910c090341a2c9b0bf022c8b387e1 # v3.4.0
+        uses: sigstore/gh-action-sigstore-python@790bc6befb9d733738f18d8f895854b453640ec9 # v3.5.0
         with:
           inputs: ./dist/*.tar.gz ./dist/*.whl
           # Self-check: verify what we just signed against THIS workflow's own
diff --git a/action.yml b/action.yml
index 484c196..d0f8aa2 100644
--- a/action.yml
+++ b/action.yml
@@ -240,7 +240,7 @@ runs:
     - name: "Upload SARIF to GitHub code scanning"
       id: sarif-upload
       if: inputs.upload-sarif == 'true' && steps.sarif-path.outputs.exists == 'true'
-      uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+      uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
       with:
         sarif_file: ${{ steps.sarif-path.outputs.sarif }}
         category: ${{ inputs.category }}