diff --git a/.github/workflows/dependabot_changelog_update.yml b/.github/workflows/dependabot_changelog_update.yml
index 0573aca89..b14cb382d 100644
--- a/.github/workflows/dependabot_changelog_update.yml
+++ b/.github/workflows/dependabot_changelog_update.yml
@@ -74,6 +74,6 @@ jobs:
           entryPrefix: 'build(deps): '
 
       - name: Commit changelog entry
-        uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 # v7.1.0
+        uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0
         with:
           commit_message: "docs(CHANGELOG.md): add dependency bump from Dependabot"
diff --git a/.github/workflows/merge_to_main.yml b/.github/workflows/merge_to_main.yml
index 2de901593..57ba191d0 100644
--- a/.github/workflows/merge_to_main.yml
+++ b/.github/workflows/merge_to_main.yml
@@ -28,7 +28,7 @@ jobs:
         with:
           node-version: 18
       - name: "Install Rust"
-        uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
         with:
           toolchain: stable
           cache: false
diff --git a/.github/workflows/pr_test.yml b/.github/workflows/pr_test.yml
index f5ebb6847..557568d9c 100644
--- a/.github/workflows/pr_test.yml
+++ b/.github/workflows/pr_test.yml
@@ -41,7 +41,7 @@ jobs:
         with:
           persist-credentials: false
       - name: "Install Rust"
-        uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
         with:
           toolchain: stable
           cache: false
@@ -63,7 +63,7 @@ jobs:
         with:
           persist-credentials: false
       - name: "Install Rust"
-        uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
         with:
           toolchain: stable
           cache: false
@@ -82,7 +82,7 @@ jobs:
       - name: "Move Config"
         run: mv config.toml pkg/config/config.toml
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9.2.1
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         with:
           version: ${{ env.GOLANGCI_LINT_VERSION }}
           only-new-issues: true
@@ -111,7 +111,7 @@ jobs:
         with:
           tinygo-version: ${{ matrix.tinygo-version }}
       - name: "Install Rust"
-        uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
         with:
           toolchain: stable
           target: wasm32-wasip1
@@ -181,7 +181,7 @@ jobs:
         with:
           tinygo-version: ${{ matrix.tinygo-version }}
       - name: "Install Rust"
-        uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
         with:
           toolchain: stable
           target: wasm32-wasip1
@@ -298,7 +298,7 @@ jobs:
           go-version: ${{ env.GO_VERSION }}
       - name: Run golangci-lint@latest
         id: lint
-        uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9.2.1
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         with:
           version: latest
           only-new-issues: true
diff --git a/.github/workflows/publish_release.yml b/.github/workflows/publish_release.yml
index ebecd3103..99418fa14 100644
--- a/.github/workflows/publish_release.yml
+++ b/.github/workflows/publish_release.yml
@@ -26,7 +26,7 @@ jobs:
             homebrew-tap
           permission-contents: write
       - name: "Download Homebrew formula artifact"
-        uses: dawidd6/action-download-artifact@bf251b5aa9c2f7eeb574a96ee720e24f801b7c11 # v6
+        uses: dawidd6/action-download-artifact@b6e2e70617bc3265edd6dab6c906732b2f1ae151 # v21
         with:
           workflow: tag_to_draft_release.yml
           name: homebrew-formula-${{ github.event.release.tag_name }}
diff --git a/.github/workflows/tag_to_draft_release.yml b/.github/workflows/tag_to_draft_release.yml
index cd99a6214..430fdcf86 100644
--- a/.github/workflows/tag_to_draft_release.yml
+++ b/.github/workflows/tag_to_draft_release.yml
@@ -28,7 +28,7 @@ jobs:
           go-version: '1.26.x'
           cache: false
       - name: "Install Rust"
-        uses: actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6 # v1.16.1
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
         with:
           toolchain: stable
           cache: false
@@ -36,7 +36,7 @@ jobs:
       - name: "Generate static app config"
         run: make config
       - name: "Run GoReleaser"
-        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
         with:
           # goreleaser version (NOT goreleaser-action version)
           # update inline with the Makefile