diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 338e652..364f1ac 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -43,7 +43,7 @@ jobs:
         run: pipx install "poetry==${POETRY_VERSION}"
 
       - name: Setup Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           cache: poetry
diff --git a/.github/workflows/commit.yml b/.github/workflows/commit.yml
index bbe31c3..bc1f420 100644
--- a/.github/workflows/commit.yml
+++ b/.github/workflows/commit.yml
@@ -137,7 +137,7 @@ jobs:
         run: pipx install "poetry==${POETRY_VERSION}"
 
       - name: Setup Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           cache: poetry
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index e24f50c..3825d02 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -92,7 +92,7 @@ jobs:
         run: pipx inject poetry "poetry-dynamic-versioning[plugin]>=1.10.0,<2.0.0"
 
       - name: Setup Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
@@ -140,11 +140,11 @@ jobs:
       - name: Publish to PyPI (trusted publishing)
         id: publish_trusted
         continue-on-error: true
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086
 
       - name: Publish to PyPI (API token fallback)
         if: steps.publish_trusted.outcome == 'failure' && env.PYPI_API_TOKEN != ''
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086
         with:
           user: __token__
           password: ${{ env.PYPI_API_TOKEN }}
@@ -212,7 +212,7 @@ jobs:
 
       - name: Create Homebrew tap app token
         id: create_tap_token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510
         with:
           client-id: ${{ env.HOMEBREW_TAP_APP_CLIENT_ID }}
           private-key: ${{ env.HOMEBREW_TAP_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index fef1a00..b361b07 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -29,7 +29,7 @@ jobs:
     steps:
       - name: Generate app token
         id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510
         with:
           # v3 requires the GitHub App client ID.
           client-id: ${{ secrets.APP_CLIENT_ID }}
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index fcd211e..6601f94 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -42,7 +42,7 @@ jobs:
         run: pipx install "poetry==${POETRY_VERSION}"
 
       - name: Setup Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           cache: poetry
@@ -60,7 +60,7 @@ jobs:
 
       - name: Secret scan
         # Scan only PR diff range to reduce noise and speed up checks.
-        uses: trufflesecurity/trufflehog@363923b901c911a9164f50b6c423f47c15372b1c
+        uses: trufflesecurity/trufflehog@31ce31ee1abbcc7dc8eee5764c17121c3044c8b2
         with:
           path: ./
           base: ${{ github.event.pull_request.base.sha }}
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index 27ce56b..8b3bec3 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -45,7 +45,7 @@ jobs:
         run: pipx install "poetry==${POETRY_VERSION}"
 
       - name: Setup Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0
         with:
           python-version: ${{ matrix.python-version }}
           cache: poetry
@@ -70,7 +70,7 @@ jobs:
         run: pipx install "poetry==${POETRY_VERSION}"
 
       - name: Setup Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           cache: poetry
@@ -95,7 +95,7 @@ jobs:
         run: pipx install "poetry==${POETRY_VERSION}"
 
       - name: Setup Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           cache: poetry