diff --git a/.github/workflows/branch-preview.yaml b/.github/workflows/branch-preview.yaml
index 22ea4b9a..668805e6 100644
--- a/.github/workflows/branch-preview.yaml
+++ b/.github/workflows/branch-preview.yaml
@@ -212,7 +212,7 @@ jobs:
       - name: SLSA build provenance for sc-${{ matrix.os }}-${{ matrix.arch }}
         id: slsa_tarball
         continue-on-error: true
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4.1.0
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4.1.1
         with:
           subject-path: .sc/stacks/dist/bundle/sc-${{ matrix.os }}-${{ matrix.arch }}-v${{ needs.prepare.outputs.version }}.tar.gz
       - name: Materialize SLSA provenance bundle next to tarball
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index eadff8e8..c3888f25 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -67,7 +67,7 @@ jobs:
       # directive), which fails the compile and surfaces as a CI red
       # rather than a real finding (gemini round-1 P2).
       - name: Set up Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6
         with:
           go-version-file: go.mod
           cache: false
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 4747a96a..b95b8904 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -36,7 +36,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Go (matching go.mod)
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6
         with:
           go-version-file: go.mod
           cache: true
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index ca7a97e4..6738bdbf 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -68,7 +68,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6
         with:
           go-version-file: go.mod
           # No build cache here — fuzz needs a clean, reproducible
diff --git a/.github/workflows/govulncheck.yml b/.github/workflows/govulncheck.yml
index db250033..40472deb 100644
--- a/.github/workflows/govulncheck.yml
+++ b/.github/workflows/govulncheck.yml
@@ -115,7 +115,7 @@ jobs:
 
       - name: Set up Go
         if: steps.gate.outputs.scan == 'true'
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c  # v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6
         with:
           go-version-file: go.mod
           cache: true
diff --git a/.github/workflows/push.yaml b/.github/workflows/push.yaml
index cc08221a..9ee794bf 100644
--- a/.github/workflows/push.yaml
+++ b/.github/workflows/push.yaml
@@ -228,7 +228,7 @@ jobs:
       - name: SLSA build provenance for sc-${{ matrix.os }}-${{ matrix.arch }}
         id: slsa_tarball
         continue-on-error: true
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4.1.0
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4.1.1
         with:
           subject-path: |
             .sc/stacks/dist/bundle/sc-${{ matrix.os }}-${{ matrix.arch }}-v${{ needs.prepare.outputs.version }}.tar.gz