diff --git a/.github/workflows/go.yaml b/.github/workflows/go.yaml
index 99db2bbe..8f62b8cf 100644
--- a/.github/workflows/go.yaml
+++ b/.github/workflows/go.yaml
@@ -47,7 +47,7 @@ jobs:
           # we always use the latest patch version.
           version: v2.14.0
       - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
         with:
           install-only: true
       - name: Show GoReleaser version
diff --git a/.github/workflows/release-sandbox.yaml b/.github/workflows/release-sandbox.yaml
index e2f706f9..1f01ef55 100644
--- a/.github/workflows/release-sandbox.yaml
+++ b/.github/workflows/release-sandbox.yaml
@@ -39,7 +39,7 @@ jobs:
           cache: false
         id: go
       - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
         with:
           install-only: true
       - name: Show GoReleaser version
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 259b05f0..ec71ddf7 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -41,18 +41,18 @@ jobs:
           cache: false
         id: go
       - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
         with:
           install-only: true
       - name: Show GoReleaser version
         run: goreleaser --version
       - name: Login to DockerHub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}
       - name: Login to GitHub Docker Registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
diff --git a/.github/workflows/updatecli.yaml b/.github/workflows/updatecli.yaml
index 2650515b..ff8a3484 100644
--- a/.github/workflows/updatecli.yaml
+++ b/.github/workflows/updatecli.yaml
@@ -16,7 +16,7 @@ jobs:
         with:
           persist-credentials: false
       - name: "Setup updatecli"
-        uses: "updatecli/updatecli-action@5d180ff09f5204e599bbd6030cd1736009ed5ff2" # v3.9.0
+        uses: "updatecli/updatecli-action@93ae2608256484ef8598e902aa675bbc9e278e4e" # v3.10.0
         with:
           version: "v0.122.1"
       - name: "Set up Go"
diff --git a/.github/workflows/updatecli_test.yaml b/.github/workflows/updatecli_test.yaml
index 6e3e663c..14d00a00 100644
--- a/.github/workflows/updatecli_test.yaml
+++ b/.github/workflows/updatecli_test.yaml
@@ -13,7 +13,7 @@ jobs:
         with:
           persist-credentials: false
       - name: "Setup updatecli"
-        uses: "updatecli/updatecli-action@5d180ff09f5204e599bbd6030cd1736009ed5ff2" # v3.9.0
+        uses: "updatecli/updatecli-action@93ae2608256484ef8598e902aa675bbc9e278e4e" # v3.10.0
         with:
           version: "v0.122.1"
       - name: "Set up Go"
diff --git a/.github/workflows/updatecli_update.yaml b/.github/workflows/updatecli_update.yaml
index 29bb0421..4b1aeca1 100644
--- a/.github/workflows/updatecli_update.yaml
+++ b/.github/workflows/updatecli_update.yaml
@@ -18,7 +18,7 @@ jobs:
         with:
           persist-credentials: false
       - name: "Setup updatecli"
-        uses: "updatecli/updatecli-action@5d180ff09f5204e599bbd6030cd1736009ed5ff2" # v3.9.0
+        uses: "updatecli/updatecli-action@93ae2608256484ef8598e902aa675bbc9e278e4e" # v3.10.0
         with:
           version: "v0.122.1"
       - name: "Set up Go"
diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml
index a35b633b..87fa32a7 100644
--- a/.github/workflows/zizmor.yaml
+++ b/.github/workflows/zizmor.yaml
@@ -16,7 +16,7 @@ jobs:
         with:
           persist-credentials: false
       - name: "Run zizmor \U0001F308"
-        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
         with:
           # intentionally not scanning the entire repository,
           inputs: ./.github/