diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3cb15ae0..26e50e90 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -504,7 +504,7 @@ jobs:
           version: v3.16.3
       - name: Report Helm version
         run: helm version --short
-      - uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0
+      - uses: helm/kind-action@06c1ae10762d3b9c1644e7fe69596ae519e015a2 # v1.15.0
         with:
           install_only: true
       - name: Prepare pytest temp directory
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 059eb128..b01fa054 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -37,4 +37,4 @@ jobs:
           path: site
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5.0.1
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 4e75582c..6f2ba69f 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -58,6 +58,6 @@ jobs:
           if-no-files-found: error
 
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: .artifacts/scorecard/results.sarif
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 2a4fe5a8..c9792c54 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -479,13 +479,13 @@ jobs:
           limit-severities-for-sarif: true
       - name: Upload Trivy API SARIF
         if: always()
-        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: .artifacts/trivy/trivy-api.sarif
           category: trivy-api-image
       - name: Upload Trivy Flink SARIF
         if: always()
-        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: .artifacts/trivy/trivy-flink.sarif
           category: trivy-flink-image
@@ -516,7 +516,7 @@ jobs:
           limit-severities-for-sarif: true
       - name: Upload Trivy IaC scan results
         if: always()
-        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: .artifacts/trivy/trivy-iac.sarif
           # Distinct category so these alerts do not collide with the image
diff --git a/.github/workflows/staging-deploy.yml b/.github/workflows/staging-deploy.yml
index 715ea232..77da1fb8 100644
--- a/.github/workflows/staging-deploy.yml
+++ b/.github/workflows/staging-deploy.yml
@@ -155,7 +155,7 @@ jobs:
         with:
           version: v3.16.3
 
-      - uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1.14.0
+      - uses: helm/kind-action@06c1ae10762d3b9c1644e7fe69596ae519e015a2 # v1.15.0
         with:
           cluster_name: agentflow-staging
           config: k8s/kind-config.yaml
diff --git a/.github/workflows/terraform-apply.yml b/.github/workflows/terraform-apply.yml
index 6fdb2558..6878dc38 100644
--- a/.github/workflows/terraform-apply.yml
+++ b/.github/workflows/terraform-apply.yml
@@ -98,7 +98,7 @@ jobs:
             *) echo "Unsupported environment: ${{ inputs.environment }}" >&2; exit 1 ;;
           esac
 
-      - uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
+      - uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4
         with:
           role-to-assume: ${{ vars.AWS_TERRAFORM_ROLE_ARN }}
           aws-region: ${{ vars.AWS_REGION }}
@@ -154,7 +154,7 @@ jobs:
             *) echo "Unsupported environment: ${{ inputs.environment }}" >&2; exit 1 ;;
           esac
 
-      - uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
+      - uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4
         with:
           role-to-assume: ${{ vars.AWS_TERRAFORM_ROLE_ARN }}
           aws-region: ${{ vars.AWS_REGION }}