diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 6b7b05999..5fac7646f 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -39,7 +39,7 @@ jobs:
             all:
               - '**'
       - name: Set up Terraform
-        uses: coder/coder/.github/actions/setup-tf@c3dd41e1e8c9d0a0860a9a81c3c050be55879dc2 # v2.34.5
+        uses: coder/coder/.github/actions/setup-tf@5c2838a7fb93874eed2d4ab8e6b6676ae4a237ce # v2.35.2
       - name: Set up Bun
         uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2
         with:
@@ -90,7 +90,7 @@ jobs:
           bun-version: latest
       # Need Terraform for its formatter
       - name: Install Terraform
-        uses: coder/coder/.github/actions/setup-tf@c3dd41e1e8c9d0a0860a9a81c3c050be55879dc2 # v2.34.5
+        uses: coder/coder/.github/actions/setup-tf@5c2838a7fb93874eed2d4ab8e6b6676ae4a237ce # v2.35.2
       - name: Install dependencies
         run: bun install
       - name: Validate formatting
@@ -109,7 +109,7 @@ jobs:
       - name: Check out code
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Set up Go
-        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
       - name: Validate contributors
diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index c9262cba7..083138347 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
       - name: golangci-lint
diff --git a/.github/workflows/version-bump.yaml b/.github/workflows/version-bump.yaml
index 288eca0fb..2d026a3a1 100644
--- a/.github/workflows/version-bump.yaml
+++ b/.github/workflows/version-bump.yaml
@@ -31,7 +31,7 @@ jobs:
           bun-version: latest
 
       - name: Set up Terraform
-        uses: coder/coder/.github/actions/setup-tf@c3dd41e1e8c9d0a0860a9a81c3c050be55879dc2 # v2.34.5
+        uses: coder/coder/.github/actions/setup-tf@5c2838a7fb93874eed2d4ab8e6b6676ae4a237ce # v2.35.2
 
       - name: Install dependencies
         run: bun install
diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml
index e9deed5ce..81656e509 100644
--- a/.github/workflows/zizmor.yaml
+++ b/.github/workflows/zizmor.yaml
@@ -27,7 +27,7 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor (blocking, HIGH only)
-        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
+        uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0
         with:
           advanced-security: false
           annotations: true
@@ -49,7 +49,7 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor (SARIF)
-        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
+        uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0
         with:
           inputs: |
             .github/workflows