diff --git a/.github/workflows/action_compliance.yaml b/.github/workflows/action_compliance.yaml
index a66db3fd2..f6f718910 100644
--- a/.github/workflows/action_compliance.yaml
+++ b/.github/workflows/action_compliance.yaml
@@ -16,7 +16,7 @@ jobs:
       - name: checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Ensure SHA pinned actions
-        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@0901cf7b71c7ea6261ec69a3dc2bd3f9264f893e # v3.0.12
+        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@5d6ac37a4cef8b8df67f482a8e384987766f0213 # v3.0.17
         with:
           allowlist: |
             slsa-framework/slsa-github-generator
diff --git a/.github/workflows/concrete_compiler_benchmark.yml b/.github/workflows/concrete_compiler_benchmark.yml
index c8a86cc0e..f713c1514 100644
--- a/.github/workflows/concrete_compiler_benchmark.yml
+++ b/.github/workflows/concrete_compiler_benchmark.yml
@@ -80,7 +80,7 @@ jobs:
           cd compilers/concrete-compiler/compiler
           make run-cpu-benchmarks
       - name: Upload raw results artifact
-        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: compiler-benchmarks-result
           path: compilers/concrete-compiler/compiler/benchmarks_results.json
@@ -114,7 +114,7 @@ jobs:
           --bench-date "${{ needs.build-and-run-benchmarks.outputs.bench_date }}" \
           --throughput
       - name: Upload parsed results artifact
-        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: compiler-benchmarks-parsed-result
           path: parsed_benchmark_results.json
diff --git a/.github/workflows/concrete_compiler_publish_docker_images.yml b/.github/workflows/concrete_compiler_publish_docker_images.yml
index cbaa3eb9d..6dc797524 100644
--- a/.github/workflows/concrete_compiler_publish_docker_images.yml
+++ b/.github/workflows/concrete_compiler_publish_docker_images.yml
@@ -47,7 +47,7 @@ jobs:
           fetch-depth: 0
       - name: Get changed files
         id: changed-files
-        uses: tj-actions/changed-files@e9772d140489982e0e3704fea5ee93d536f1e275 # v44.5.24
+        uses: tj-actions/changed-files@4edd678ac3f81e2dc578756871e4d00c19191daf # v44.5.24
       - name: Login
         id: login
         if: contains(steps.changed-files.outputs.modified_files, env.dockerfile) || contains(steps.changed-files.outputs.modified_files, env.THIS_FILE)
@@ -100,7 +100,7 @@ jobs:
           echo "HOME=/home/ubuntu" >> "${GITHUB_ENV}"
       - name: Get changed files
         id: changed-files
-        uses: tj-actions/changed-files@e9772d140489982e0e3704fea5ee93d536f1e275 # v44.5.24
+        uses: tj-actions/changed-files@4edd678ac3f81e2dc578756871e4d00c19191daf # v44.5.24
       - name: Login
         id: login
         # from the docs: The jobs.<job_id>.if condition is evaluated before jobs.<job_id>.strategy.matrix is applied. So we can't just use matrix.dockerfile
@@ -149,7 +149,7 @@ jobs:
           submodules: recursive
       - name: Get changed files
         id: changed-files
-        uses: tj-actions/changed-files@e9772d140489982e0e3704fea5ee93d536f1e275 # v44.5.24
+        uses: tj-actions/changed-files@4edd678ac3f81e2dc578756871e4d00c19191daf # v44.5.24
         with:
           files: |
             backends/**
diff --git a/.github/workflows/concrete_ml_test.yml b/.github/workflows/concrete_ml_test.yml
index f8f452d50..c1d8acec9 100644
--- a/.github/workflows/concrete_ml_test.yml
+++ b/.github/workflows/concrete_ml_test.yml
@@ -95,7 +95,7 @@ jobs:
             deactivate
 
       - name: Setup Python
-        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
+        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: ML Tests
diff --git a/.github/workflows/concrete_optimizer.yml b/.github/workflows/concrete_optimizer.yml
index eee82b832..41d157ecc 100644
--- a/.github/workflows/concrete_optimizer.yml
+++ b/.github/workflows/concrete_optimizer.yml
@@ -81,7 +81,7 @@ jobs:
           if_no_artifact_found: warn
           path: ./benchmark
       - name: Save benchmark result to file
-        uses: benchmark-action/github-action-benchmark@4de1bed97a47495fc4c5404952da0499e31f5c29 # v1.20.3
+        uses: benchmark-action/github-action-benchmark@d48d326b4ca9ba73ca0cd0d59f108f9e02a381c7 # v1.20.4
         with:
           tool: 'cargo'
           output-file-path: ./compilers/concrete-optimizer/bench_result.txt
@@ -93,7 +93,7 @@ jobs:
           # Enable Job Summary for PRs
           summary-always: true
       - name: Upload benchmark data
-        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           path: ./benchmark
           name: ${{ runner.os }}-benchmark
diff --git a/.github/workflows/concrete_python_release_cpu.yml b/.github/workflows/concrete_python_release_cpu.yml
index 108064de2..138936042 100644
--- a/.github/workflows/concrete_python_release_cpu.yml
+++ b/.github/workflows/concrete_python_release_cpu.yml
@@ -125,7 +125,7 @@ jobs:
 
             deactivate
       - name: Upload wheel
-        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: ${{ format('wheel-{0}-linux-x86', matrix.python-version) }}
           path: frontends/concrete-python/dist/*manylinux*.whl
@@ -200,7 +200,7 @@ jobs:
 
           deactivate
       - name: Upload wheel
-        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: ${{ format('wheel-{0}-{1}', matrix.python-version, matrix.runs-on) }}
           path: frontends/concrete-python/dist/*macos*.whl
@@ -307,7 +307,7 @@ jobs:
           toolchain: nightly
           default: true
       - name: Setup Python
-        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
+        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
         with:
           python-version: ${{ matrix.python-version }}
       - name: Download wheels
diff --git a/.github/workflows/concrete_python_release_gpu.yml b/.github/workflows/concrete_python_release_gpu.yml
index fe71c0862..519359db0 100644
--- a/.github/workflows/concrete_python_release_gpu.yml
+++ b/.github/workflows/concrete_python_release_gpu.yml
@@ -105,7 +105,7 @@ jobs:
 
             deactivate
       - name: Upload wheel
-        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: ${{ format('wheel-{0}-linux-x86', matrix.python-version) }}
           path: frontends/concrete-python/dist/*manylinux*.whl
@@ -218,7 +218,7 @@ jobs:
           toolchain: nightly
           default: true
       - name: Setup Python
-        uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0
+        uses: actions/setup-python@0b93645e9fea7318ecaed2b359559ac225c90a2b # v5.3.0
         with:
           python-version: ${{ matrix.python-version }}
 
diff --git a/.github/workflows/concrete_python_tests_linux.yml b/.github/workflows/concrete_python_tests_linux.yml
index a53c16bb7..5a6719745 100644
--- a/.github/workflows/concrete_python_tests_linux.yml
+++ b/.github/workflows/concrete_python_tests_linux.yml
@@ -96,7 +96,7 @@ jobs:
             cd build
             tar czvf artifacts.tgz lib/libConcretelangRuntime.so tools/concretelang/python_packages
       - name: Upload concrete-compiler python-bindings
-        uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: concrete-compiler-python-bindings
           include-hidden-files: true