diff --git a/.github/workflows/gradle-build.yml b/.github/workflows/gradle-build.yml
index 4bfaf17..b9d063b 100644
--- a/.github/workflows/gradle-build.yml
+++ b/.github/workflows/gradle-build.yml
@@ -75,7 +75,7 @@ jobs:
           persist-credentials: false
 
       - name: Validate Gradle wrapper
-        uses: gradle/actions/wrapper-validation@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
+        uses: gradle/actions/wrapper-validation@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
 
       - name: Set up JDK ${{ inputs.java-version }}
         uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
@@ -88,7 +88,7 @@ jobs:
         run: chmod +x ./gradlew
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
+        uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
         with:
           cache-provider: basic
 
@@ -105,7 +105,7 @@ jobs:
 
       - name: Upload test results
         if: ${{ inputs.upload-test-results && !cancelled() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ inputs.test-results-artifact }}
           path: ${{ inputs.test-results-path }}
diff --git a/.github/workflows/gradle-publish.yml b/.github/workflows/gradle-publish.yml
index 62b44e1..20d6875 100644
--- a/.github/workflows/gradle-publish.yml
+++ b/.github/workflows/gradle-publish.yml
@@ -74,7 +74,7 @@ jobs:
           persist-credentials: false
 
       - name: Validate Gradle wrapper
-        uses: gradle/actions/wrapper-validation@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
+        uses: gradle/actions/wrapper-validation@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
 
       - name: Set up JDK ${{ inputs.java-version }}
         uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
@@ -87,7 +87,7 @@ jobs:
         run: chmod +x ./gradlew
 
       - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
+        uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
         with:
           cache-provider: basic
 
@@ -100,7 +100,7 @@ jobs:
 
       - name: Upload build artifacts
         if: ${{ inputs.upload-jars }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: build-artifacts
           path: ${{ inputs.jar-path }}
diff --git a/.github/workflows/node-build.yml b/.github/workflows/node-build.yml
index b65a21c..a78e7c9 100644
--- a/.github/workflows/node-build.yml
+++ b/.github/workflows/node-build.yml
@@ -82,7 +82,7 @@ jobs:
       # so passing both is safe. Callers that must pin explicitly pass node-version
       # and node-version-file: ''.
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ inputs.node-version }}
           node-version-file: ${{ inputs.node-version-file }}
@@ -132,7 +132,7 @@ jobs:
 
       - name: Upload test results
         if: ${{ inputs.upload-test-results && !cancelled() }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ inputs.test-results-artifact }}
           path: ${{ inputs.test-results-path }}
diff --git a/.github/workflows/test-report.yml b/.github/workflows/test-report.yml
index 20a5399..816a3f5 100644
--- a/.github/workflows/test-report.yml
+++ b/.github/workflows/test-report.yml
@@ -76,7 +76,7 @@ jobs:
 
       # pull-requests: write is deliberately absent — with use-actions-summary: false
       # this publishes a check run and never comments on a PR.
-      - uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
+      - uses: dorny/test-reporter@d1b5dff021aa968b288b02285a8bf47471c5928a # v3.2.0
         if: steps.probe.outputs.found == 'true'
         with:
           artifact: ${{ inputs.artifact }}