diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 25b1fec..d5c8091 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -43,7 +43,7 @@ jobs:
           echo "archive=$archive" >> "$GITHUB_OUTPUT"
 
       - name: Generate CycloneDX SBOM
-        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
+        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
         with:
           artifact-name: ${{ steps.source.outputs.archive }}.cdx.json
           format: cyclonedx-json
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index add9cfe..a49fec8 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -68,7 +68,7 @@ jobs:
       # MSRV (cargo-audit 0.22.2 requires Rust >=1.88) from the audited
       # crate's MSRV (1.85). The exact scanner version is pinned and
       # deliberately reviewed, never floated.
-      - uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375 # v2.87.12
+      - uses: taiki-e/install-action@8cca0918f8471c33515202b73f56ab27f2bed283 # v2.87.29
         with:
           tool: cargo-audit@0.22.2
       - name: cargo audit
@@ -79,7 +79,7 @@ jobs:
 
   osv-scanner:
     name: osv scanner
-    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@6e4298ebc4db23e847df9b2e2de2939d6f066c67
+    uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@b1d267aea5211fa648d9d442fa64b90dbdcbdd36
     permissions:
       actions: read
       contents: read