diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
index 799dbdfe..98781d84 100644
--- a/.github/workflows/codeql.yaml
+++ b/.github/workflows/codeql.yaml
@@ -44,7 +44,7 @@ jobs:
         with:
           go-version: stable # matches verify.yaml (go.mod minimum, CI on latest stable)
 
-      - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+      - uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -53,6 +53,6 @@ jobs:
         name: Build for CodeQL
         run: go build -mod=readonly ./...
 
-      - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+      - uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index a232701d..8acd3f96 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -105,7 +105,7 @@ jobs:
 
       - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
 
-      - uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+      - uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
 
       - name: Build release assets
         uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
@@ -149,7 +149,7 @@ jobs:
           github_token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Publish GitHub Release
-        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           tag_name: ${{ steps.version.outputs.tag }}
           name: assent ${{ steps.version.outputs.version }}
diff --git a/.github/workflows/scorecard.yaml b/.github/workflows/scorecard.yaml
index f7a37a95..2cb5d013 100644
--- a/.github/workflows/scorecard.yaml
+++ b/.github/workflows/scorecard.yaml
@@ -37,7 +37,7 @@ jobs:
           publish_results: true
 
       - name: Upload SARIF to code scanning
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: results.sarif
           category: scorecard
diff --git a/CHANGELOG.md b/CHANGELOG.md
index e1173406..51e0da7f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -84,6 +84,9 @@ repository still gets a decision, never by following the link; no release carrie
 - build(deps): bump github/codeql-action/init from 4.37.7 to 4.37.8
 - build(deps): bump github/codeql-action/analyze from 4.37.7 to 4.37.8
 - build(deps): bump github/codeql-action/upload-sarif
+- :arrow_up: build(deps): bump all three github/codeql-action refs to v4.37.9
+- :arrow_up: build(deps): bump sbom-action to v0.24.2 and action-gh-release to v3.0.3
+- :arrow_up: build(deps): bump fast-uri from 3.1.5 to 3.1.7 in schemas-validator
 
 ### Documentation
 - :memo: docs(changelog): stamp the v0.3.0 section after tagging
diff --git a/hack/schemas-validator/package-lock.json b/hack/schemas-validator/package-lock.json
index e8fd6e23..f79c1699 100644
--- a/hack/schemas-validator/package-lock.json
+++ b/hack/schemas-validator/package-lock.json
@@ -129,9 +129,9 @@
       "license": "MIT"
     },
     "node_modules/fast-uri": {
-      "version": "3.1.5",
-      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.5.tgz",
-      "integrity": "sha512-gHwA1O9LDIcKunMKhObS/HimwtehO1nPUECKAu5TpKgaO19fcWEl4bliWe1jWxVFvIXztJjjQ4L8XQ1EU9f7Jw==",
+      "version": "3.1.7",
+      "resolved": "https://registry.npmjs.org/fast-uri/-/fast-uri-3.1.7.tgz",
+      "integrity": "sha512-dOvZVzjdZdz7phd9v6jCbwxrBW3fK6n8Rc0CtdmM4bumzMnxywBYhuph6J819RRw/ku+rLbelwfMunktuzVVHg==",
       "funding": [
         {
           "type": "github",