diff --git a/.github/workflows/checks.yml b/.github/workflows/checks.yml
index 450237f7..a299fccb 100644
--- a/.github/workflows/checks.yml
+++ b/.github/workflows/checks.yml
@@ -18,7 +18,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
           cache: npm
diff --git a/.github/workflows/container-scan.yml b/.github/workflows/container-scan.yml
index f5c7c9ba..41aad46e 100644
--- a/.github/workflows/container-scan.yml
+++ b/.github/workflows/container-scan.yml
@@ -66,7 +66,7 @@ jobs:
 
       - name: Upload merged SARIF to GitHub Security tab
         if: ${{ !cancelled() && hashFiles(env.CONTAINER_SCAN_MERGED_SARIF_OUTPUT) != '' }}
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.31.2
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.31.2
         with:
           sarif_file: ${{ env.CONTAINER_SCAN_MERGED_SARIF_OUTPUT }}
           category: container-scan
diff --git a/.github/workflows/publish_images.yml b/.github/workflows/publish_images.yml
index c027c4c5..76c4b061 100644
--- a/.github/workflows/publish_images.yml
+++ b/.github/workflows/publish_images.yml
@@ -22,7 +22,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #v7.0.1
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e #v4.3.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 #v4.4.1
 
       - name: Harbor connectivity probe
         run: |
@@ -70,7 +70,7 @@ jobs:
             ${{ runner.os }}-buildx-platform-ui-
 
       - name: Build PLATFORM-UI docker image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a #v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc #v7.4.0
         with:
           context: .
           file: ./Dockerfile
diff --git a/.github/workflows/sast.yml b/.github/workflows/sast.yml
index abe93cd3..eaa0a8df 100644
--- a/.github/workflows/sast.yml
+++ b/.github/workflows/sast.yml
@@ -40,7 +40,7 @@ jobs:
 
       - name: Upload SARIF to GitHub Security tab
         if: ${{ !cancelled() && hashFiles(env.OPENGREP_SARIF_OUTPUT) != '' }}
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.31.2
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.31.2
         with:
           sarif_file: ${{ env.OPENGREP_SARIF_OUTPUT }}
           category: semgrep-app
diff --git a/.github/workflows/sca.yml b/.github/workflows/sca.yml
index 5e14834b..8c1bd2a9 100644
--- a/.github/workflows/sca.yml
+++ b/.github/workflows/sca.yml
@@ -50,7 +50,7 @@ jobs:
 
       - name: Upload merged SARIF to GitHub Security tab
         if: ${{ !cancelled() && hashFiles(env.SCA_MERGED_SARIF_OUTPUT) != '' }}
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.31.2
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.31.2
         with:
           sarif_file: ${{ env.SCA_MERGED_SARIF_OUTPUT }}
           category: sca-app
diff --git a/.github/workflows/secrets-scan.yml b/.github/workflows/secrets-scan.yml
index 9101ca35..7551b54b 100644
--- a/.github/workflows/secrets-scan.yml
+++ b/.github/workflows/secrets-scan.yml
@@ -34,7 +34,7 @@ jobs:
 
       - name: Upload SARIF to code scanning
         if: always()
-        uses: github/codeql-action/upload-sarif@1cf8f518e1ad217271451b975391e639ea196e55 #v2.25.6
+        uses: github/codeql-action/upload-sarif@61817fadad823920a8924645dd5f67985d6a1d94 #v2.25.6
         with:
           sarif_file: ${{ env.GITLEAKS_SARIF_OUTPUT }}
           category: gitleaks