diff --git a/.github/workflows/azure-dev.yaml b/.github/workflows/azure-dev.yaml
index a311c10..3926571 100644
--- a/.github/workflows/azure-dev.yaml
+++ b/.github/workflows/azure-dev.yaml
@@ -28,10 +28,10 @@ jobs:
             AZURE_LOCATION: ${{ vars.AZURE_LOCATION }}
         steps:
             - name: Checkout
-              uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
             - name: Install azd
-              uses: Azure/setup-azd@e0f7ef82e0fc80bab7170ec70e55fc3a6bc5cb4e # v1.0.0
+              uses: Azure/setup-azd@0b7e3a35ab00f2eee7080c845eb39c3f0ebfa553 # v2.4.0
 
             - name: Log in with Azure (Federated Credentials)
               if: ${{ env.AZURE_CLIENT_ID != '' }}
diff --git a/.github/workflows/build-test.yaml b/.github/workflows/build-test.yaml
index 40e6d68..d095b88 100644
--- a/.github/workflows/build-test.yaml
+++ b/.github/workflows/build-test.yaml
@@ -16,9 +16,9 @@ jobs:
     runs-on: ${{ matrix.platform }}
     steps:
       - run: git config --global core.autocrlf false
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Setup Node.js v${{ matrix.node-version }}
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node-version }}
       - name: Install dependencies
diff --git a/.github/workflows/validate-infra.yaml b/.github/workflows/validate-infra.yaml
index 2e37110..d2d7f8d 100644
--- a/.github/workflows/validate-infra.yaml
+++ b/.github/workflows/validate-infra.yaml
@@ -16,10 +16,10 @@ jobs:
       security-events: write
     steps:
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Build Bicep for linting
-        uses: azure/CLI@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0
+        uses: azure/CLI@9eb25b8360668fb0ecbafa808d40e2197b2f5f52 # v3.0.0
         with:
           inlineScript: az config set bicep.use_binary_from_path=false && az bicep build -f infra/main.bicep --stdout
 
@@ -32,6 +32,6 @@ jobs:
 
       - name: Upload alerts to Security tab
         if: github.repository_owner == 'Azure-Samples'
-        uses: github/codeql-action/upload-sarif@6f5948dfacef28e207b48d0905cf90c03365536d # v3.37.9
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: ${{ steps.msdo.outputs.sarifFile }}
\ No newline at end of file