diff --git a/.github/workflows/asf-allowlist.yml b/.github/workflows/asf-allowlist.yml
index 28441e6012..ca08323093 100644
--- a/.github/workflows/asf-allowlist.yml
+++ b/.github/workflows/asf-allowlist.yml
@@ -32,6 +32,6 @@ jobs:
         with:
           persist-credentials: false
       - name: Check ASF GitHub Actions allowlist
-        uses: apache/infrastructure-actions/allowlist-check@bddab88ea4e4874c2c159c18f3017b51ec278d03
+        uses: apache/infrastructure-actions/allowlist-check@e3e0a2261a9c6d5bdd882802b303f34b1511b6df
         with:
           scan-glob: ".github/**/*.y*ml"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 41c2b22449..6d74a9b8d0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -347,7 +347,7 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-maven-
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
+        uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
         with:
           gradle-version: "8.13"
       - name: Install Fory Java and Kotlin JSON artifacts
@@ -661,7 +661,7 @@ jobs:
         java-version: ["17", "25"]
     steps:
       - uses: actions/checkout@v7.0.1
-      - uses: graalvm/setup-graalvm@0426e2e191540e8514dff98dc52a5f5146a2a276 # v1.6.6
+      - uses: graalvm/setup-graalvm@27b360dbb857524eaf0b4c4cef364d38e5b4f173 # v1.6.7
         with:
           java-version: ${{ matrix.java-version }}
           distribution: "graalvm"
@@ -688,7 +688,7 @@ jobs:
         java-version: ["17", "25"]
     steps:
       - uses: actions/checkout@v7.0.1
-      - uses: graalvm/setup-graalvm@0426e2e191540e8514dff98dc52a5f5146a2a276 # v1.6.6
+      - uses: graalvm/setup-graalvm@27b360dbb857524eaf0b4c4cef364d38e5b4f173 # v1.6.7
         with:
           java-version: ${{ matrix.java-version }}
           distribution: "graalvm"
@@ -712,7 +712,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7.0.1
-      - uses: graalvm/setup-graalvm@0426e2e191540e8514dff98dc52a5f5146a2a276 # v1.6.6
+      - uses: graalvm/setup-graalvm@27b360dbb857524eaf0b4c4cef364d38e5b4f173 # v1.6.7
         with:
           java-version: "25"
           distribution: "graalvm"
@@ -783,7 +783,7 @@ jobs:
         with:
           java-version: 11
           distribution: "temurin"
-      - uses: sbt/setup-sbt@ce95da69b39609ea153bad087708da5f37366897 # v1.5.10
+      - uses: sbt/setup-sbt@6158cb0903b8ceeae04f830055f3155e1b6a5ad7 # v1.5.11
         with:
           disk-cache: false
       - name: Install fory java
@@ -810,7 +810,7 @@ jobs:
         uses: actions/setup-python@v7.0.0
         with:
           python-version: 3.11
-      - uses: sbt/setup-sbt@ce95da69b39609ea153bad087708da5f37366897 # v1.5.10
+      - uses: sbt/setup-sbt@6158cb0903b8ceeae04f830055f3155e1b6a5ad7 # v1.5.11
         with:
           disk-cache: false
       - name: Run Scala Xlang Test
@@ -838,7 +838,7 @@ jobs:
         uses: actions/setup-python@v7.0.0
         with:
           python-version: 3.11
-      - uses: sbt/setup-sbt@ce95da69b39609ea153bad087708da5f37366897 # v1.5.10
+      - uses: sbt/setup-sbt@6158cb0903b8ceeae04f830055f3155e1b6a5ad7 # v1.5.11
         with:
           disk-cache: false
       - name: Install Fory Java
diff --git a/.github/workflows/release-jvm-snapshot.yaml b/.github/workflows/release-jvm-snapshot.yaml
index a46ec7a860..0af65973d5 100644
--- a/.github/workflows/release-jvm-snapshot.yaml
+++ b/.github/workflows/release-jvm-snapshot.yaml
@@ -45,7 +45,7 @@ jobs:
           server-id: apache.snapshots.https
           server-username: NEXUS_USERNAME
           server-password: NEXUS_PASSWORD
-      - uses: sbt/setup-sbt@ce95da69b39609ea153bad087708da5f37366897 # v1.5.10
+      - uses: sbt/setup-sbt@6158cb0903b8ceeae04f830055f3155e1b6a5ad7 # v1.5.11
         with:
           disk-cache: false
       - name: Publish Java and Kotlin snapshots