diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1c5b99f0..e4d63ceb 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -41,7 +41,7 @@ jobs:
           - qt-version: ${{ inputs.os == 'windows-2025' && '6.2.4' || 'none' }} # stdext: undeclared identifier - removed in vs2026
     steps:
       - name: Checkout source code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
 
       - name: Set up ccache
         uses: hendrikmuhs/ccache-action@d62db5f07c26379fc4b4e0916f098a92573c3b03
@@ -53,7 +53,7 @@ jobs:
             ${{ inputs.os }}
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e
+        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9
         with:
           languages: cpp
           queries: security-and-quality
@@ -203,7 +203,7 @@ jobs:
           upload-release-assets: false
 
       - name: Attest artifacts
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373
         with:
           subject-path: build/${{ inputs.build-config }}/dist/EFIBootEditor-*
 
@@ -215,7 +215,7 @@ jobs:
           path: build/${{ inputs.build-config }}/dist/EFIBootEditor-*
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e
+        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9
         if: inputs.build-config == 'Debug'
         continue-on-error: true
 
diff --git a/.github/workflows/draft_release.yml b/.github/workflows/draft_release.yml
index 05bc3fc3..11d47fbc 100644
--- a/.github/workflows/draft_release.yml
+++ b/.github/workflows/draft_release.yml
@@ -11,6 +11,6 @@ jobs:
       contents: write
       pull-requests: read
     steps:
-      - uses: release-drafter/release-drafter@693d20e7c1ce1a81d3a41962f85914253b518449
+      - uses: release-drafter/release-drafter@4d75298e00d9e34c483e5ff8c68d0ea1c1940c1e
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml
index 6bd4c690..ee6c3bb7 100644
--- a/.github/workflows/format.yml
+++ b/.github/workflows/format.yml
@@ -6,8 +6,8 @@ jobs:
   clang-format:
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
-      - uses: cpp-linter/cpp-linter-action@77c390c5ba9c947ebc185a3e49cc754f1558abb5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: cpp-linter/cpp-linter-action@8e85cd02c8c3fe3ae527c94b5683fe2366b144ed
         id: linter
         with:
           version: 22
diff --git a/.github/workflows/qt_update.yml b/.github/workflows/qt_update.yml
index d24bc337..ca3b6daf 100644
--- a/.github/workflows/qt_update.yml
+++ b/.github/workflows/qt_update.yml
@@ -29,18 +29,18 @@ jobs:
             --force
 
       - name: Checkout source code
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
         with:
           token: ${{ secrets.BOT_ACCESS_TOKEN }}
           repository: EFIBootEditorBot/efibooteditor
 
       - name: Install uv
-        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990
         with:
           enable-cache: true
 
       - name: Install python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405
+        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
         with:
           python-version: '3.14'
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 913f22f5..a2f54045 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -130,12 +130,12 @@ jobs:
         shell: bash
 
       - name: Attest release assets
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373
         with:
           subject-path: dist/EFIBootEditor-*
 
       - name: Upload assets to release
-        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b
         with:
           files: dist/EFIBootEditor-*
           tag_name: ${{ github.ref_name }}