diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ebf5f61..fa2d615 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -76,7 +76,7 @@ jobs:
             fi
 
       - name: Clone latest repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ steps.set_inputs.outputs.ref }}
           submodules: ${{ inputs.submodules }}
@@ -88,7 +88,7 @@ jobs:
           tag: ${{ steps.set_inputs.outputs.ref }}
 
       - name: Log into container registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
         with:
           registry: "ghcr.io"
           username: ${{ github.actor }}
@@ -127,16 +127,16 @@ jobs:
       - name: Set up QEMU
         if: ${{ steps.image_check.outputs.image_exists != 'true' || inputs.rebuild }}
         # QEMU emulation for the Arm portion of our multi-platform Docker image build. Intel Machines
-        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
 
       - name: Set up Docker Buildx
         if: ${{ steps.image_check.outputs.image_exists != 'true' || inputs.rebuild }}
         # Required for multi-platform Docker image builds in GitHub Actions that use docker/build-push-action.
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Build image and push to GHCR
         if: ${{ steps.image_check.outputs.image_exists != 'true' || inputs.rebuild }}
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           push: true
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index b0e622b..d359678 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -36,7 +36,7 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Set environment variables
@@ -60,7 +60,7 @@ jobs:
           fi
       - name: Generate app token
         id: generate_token
-        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           client-id: ${{ vars.CONFIG_REPO_RW_APP_ID }}
           private-key: ${{ secrets.CONFIG_REPO_RW_KEY }}
diff --git a/.github/workflows/tag-release.yml b/.github/workflows/tag-release.yml
index 81213d2..f5fa2fd 100644
--- a/.github/workflows/tag-release.yml
+++ b/.github/workflows/tag-release.yml
@@ -32,7 +32,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Log into container registry
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
 
         with:
           registry: "ghcr.io"
diff --git a/.github/workflows/update-image.yml b/.github/workflows/update-image.yml
index 04b96b0..8b08242 100644
--- a/.github/workflows/update-image.yml
+++ b/.github/workflows/update-image.yml
@@ -26,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Clone latest repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: dump github event
         shell: bash
         env: