diff --git a/.github/workflows/ci-rust.yml b/.github/workflows/ci-rust.yml
index 0d86a134f1d..faf7a7e8017 100644
--- a/.github/workflows/ci-rust.yml
+++ b/.github/workflows/ci-rust.yml
@@ -96,7 +96,7 @@ jobs:
         timeout-minutes: 5
 
       # Install cargo nextest command
-      - uses: taiki-e/install-action@a1f180f99a1c725ceb0e42382d8aa2402edf1558 # pin v2.22.5
+      - uses: taiki-e/install-action@56ab7930c591507f833cbaed864d201386d518a8 # pin v2.23.7
         with:
           tool: nextest@0.9.54, wasm-pack@0.11.0, cargo-deny@0.14.3
 
@@ -235,7 +235,7 @@ jobs:
           mv 'D:/a/_temp/winfsp-tests-x64.exe' 'C:/Program Files (x86)/WinFsp/bin/'
 
       # Install cargo nextest command
-      - uses: taiki-e/install-action@a1f180f99a1c725ceb0e42382d8aa2402edf1558 # pin v2.22.5
+      - uses: taiki-e/install-action@56ab7930c591507f833cbaed864d201386d518a8 # pin v2.23.7
         with:
           tool: nextest@0.9.54
 
diff --git a/.github/workflows/ci-web.yml b/.github/workflows/ci-web.yml
index 9f1b2358541..4f7326c1377 100644
--- a/.github/workflows/ci-web.yml
+++ b/.github/workflows/ci-web.yml
@@ -43,7 +43,7 @@ jobs:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # pin v4.1.1
         timeout-minutes: 5
 
-      - uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65  # pin v4.0.0
+      - uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8  # pin v4.0.1
         with:
           node-version: ${{ env.node-version }}
         timeout-minutes: 2
@@ -110,7 +110,7 @@ jobs:
         timeout-minutes: 5
 
       # Install wasm-pack command
-      - uses: taiki-e/install-action@a1f180f99a1c725ceb0e42382d8aa2402edf1558 # pin v2.22.5
+      - uses: taiki-e/install-action@56ab7930c591507f833cbaed864d201386d518a8 # pin v2.23.7
         with:
           tool: wasm-pack@${{ env.wasm-pack-version }}
 
diff --git a/.github/workflows/cspell.yml b/.github/workflows/cspell.yml
index 64b60f9902c..c35cf5450eb 100644
--- a/.github/workflows/cspell.yml
+++ b/.github/workflows/cspell.yml
@@ -74,7 +74,7 @@ jobs:
 
       - name: Check spelling in the repository
         id: cspell
-        uses: streetsidesoftware/cspell-action@6043e383e6abacdc8b8a0d97756586da8d0d985d # pin v5.1.0
+        uses: streetsidesoftware/cspell-action@ca9b36c60db5c4b2a2532b2ade8d02d1b8c9ed1d # pin v5.2.0
         with:
           config: .cspell/cspell.config.yml
           # Only check for changed files on a PR
diff --git a/.github/workflows/docker-server.yml b/.github/workflows/docker-server.yml
index 4e091f4c679..344aa81eb5f 100644
--- a/.github/workflows/docker-server.yml
+++ b/.github/workflows/docker-server.yml
@@ -49,7 +49,7 @@ jobs:
           sed -n 's/^.*Tool.Parsec: "\(.*\)",$/current=\1/p' misc/version_updater.py | tee $GITHUB_OUTPUT
 
       - name: Generate build metadata
-        uses: docker/metadata-action@31cebacef4805868f9ce9a0cb03ee36c32df2ac4 # v5.3.0
+        uses: docker/metadata-action@9dc751fe249ad99385a2583ee0d084c400eee04e # v5.4.0
         id: metadata
         with:
           images:
diff --git a/.github/workflows/docker-testbed.yml b/.github/workflows/docker-testbed.yml
index 2d08bce7d90..f89ef66428b 100644
--- a/.github/workflows/docker-testbed.yml
+++ b/.github/workflows/docker-testbed.yml
@@ -62,7 +62,7 @@ jobs:
         timeout-minutes: 1
 
       - name: Generate build metadata
-        uses: docker/metadata-action@31cebacef4805868f9ce9a0cb03ee36c32df2ac4 # v5.3.0
+        uses: docker/metadata-action@9dc751fe249ad99385a2583ee0d084c400eee04e # v5.4.0
         id: metadata
         with:
           images:
diff --git a/.github/workflows/package-ionic-app.yml b/.github/workflows/package-ionic-app.yml
index 3465d6e052e..85150bf06fb 100644
--- a/.github/workflows/package-ionic-app.yml
+++ b/.github/workflows/package-ionic-app.yml
@@ -31,7 +31,7 @@ jobs:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # pin v4.1.1
         timeout-minutes: 5
 
-      - uses: actions/setup-node@8f152de45cc393bb48ce5d89d36b731f54556e65  # pin v4.0.0
+      - uses: actions/setup-node@b39b52d1213e96004bfcb1c61a8a6fa8ab84f3e8  # pin v4.0.1
         with:
           node-version: ${{ env.node-version }}
         timeout-minutes: 2
@@ -41,7 +41,7 @@ jobs:
         working-directory: client
 
       # Install syft
-      - uses: taiki-e/install-action@a1f180f99a1c725ceb0e42382d8aa2402edf1558 # pin v2.22.5
+      - uses: taiki-e/install-action@56ab7930c591507f833cbaed864d201386d518a8 # pin v2.23.7
         with:
           tool: syft@0.84.0, wasm-pack@${{ env.wasm-pack-version }}
 
@@ -118,7 +118,7 @@ jobs:
         timeout-minutes: 5
 
       # Install syft
-      - uses: taiki-e/install-action@a1f180f99a1c725ceb0e42382d8aa2402edf1558 # pin v2.22.5
+      - uses: taiki-e/install-action@56ab7930c591507f833cbaed864d201386d518a8 # pin v2.23.7
         with:
           tool: syft@0.84.0
 
diff --git a/.github/workflows/package-server.yml b/.github/workflows/package-server.yml
index 90e774769ef..7fb3c0a3abf 100644
--- a/.github/workflows/package-server.yml
+++ b/.github/workflows/package-server.yml
@@ -139,7 +139,7 @@ jobs:
         run: python server/packaging/wheel/wheel_it.py ./server --output dist --skip-wheel
 
       # Install syft
-      - uses: taiki-e/install-action@a1f180f99a1c725ceb0e42382d8aa2402edf1558 # pin v2.22.5
+      - uses: taiki-e/install-action@56ab7930c591507f833cbaed864d201386d518a8 # pin v2.23.7
         with:
           tool: syft@0.84.0
 
diff --git a/.github/workflows/releaser.yml b/.github/workflows/releaser.yml
index 0d28cc2c094..31a6cc40b93 100644
--- a/.github/workflows/releaser.yml
+++ b/.github/workflows/releaser.yml
@@ -86,7 +86,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Download every artifact generated (and uploaded)
-        uses: actions/download-artifact@7a1cd3216ca9260cd8022db641d960b1db4d1be4 # pin v4.0.0
+        uses: actions/download-artifact@f44cd7b40bfd40b6aa1cc1b9b5b7bf03d3c67110 # pin v4.1.0
         with:
           path: artifacts
         timeout-minutes: 5