diff --git a/.github/actions/melange-build/action.yaml b/.github/actions/melange-build/action.yaml
index 61781e6..82a6d0e 100644
--- a/.github/actions/melange-build/action.yaml
+++ b/.github/actions/melange-build/action.yaml
@@ -31,7 +31,7 @@ runs:
   using: composite
   steps:
     - name: Install melange
-      uses: chainguard-dev/actions/setup-melange@fabe4ed3f66ceb5f8ec86ed7ae6d0c945ca362fb # v1.6.28
+      uses: chainguard-dev/actions/setup-melange@b2555de0cf9724fb9b49d050ff18bd1f49562ba7 # v1.6.29
       with:
         version: ${{ inputs.melange-version }}
 
@@ -70,7 +70,7 @@ runs:
         fi
 
     - name: Build package with melange
-      uses: chainguard-dev/actions/melange-build-pkg@fabe4ed3f66ceb5f8ec86ed7ae6d0c945ca362fb # v1.6.28
+      uses: chainguard-dev/actions/melange-build-pkg@b2555de0cf9724fb9b49d050ff18bd1f49562ba7 # v1.6.29
       with:
         config: melange.yaml
         archs: ${{ inputs.arch }}
diff --git a/.github/actions/scan-image/action.yaml b/.github/actions/scan-image/action.yaml
index 4613e25..846ea87 100644
--- a/.github/actions/scan-image/action.yaml
+++ b/.github/actions/scan-image/action.yaml
@@ -78,7 +78,7 @@ runs:
         mv "$tmpfile" "cve-report-${{ inputs.image-name }}-${{ inputs.arch }}.json"
 
     - name: Upload Grype SARIF
-      uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+      uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
       with:
         sarif_file: ${{ steps.grype-sarif.outputs.sarif }}
         category: grype-${{ inputs.image-name }}-${{ inputs.arch }}
@@ -91,7 +91,7 @@ runs:
         output: trivy-results-${{ inputs.image-name }}-${{ inputs.arch }}.sarif
 
     - name: Upload Trivy SARIF
-      uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
+      uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
       with:
         sarif_file: trivy-results-${{ inputs.image-name }}-${{ inputs.arch }}.sarif
         category: trivy-${{ inputs.image-name }}-${{ inputs.arch }}
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index e63f386..372638b 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -193,12 +193,12 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install melange
-        uses: chainguard-dev/actions/setup-melange@fabe4ed3f66ceb5f8ec86ed7ae6d0c945ca362fb # v1.6.28
+        uses: chainguard-dev/actions/setup-melange@b2555de0cf9724fb9b49d050ff18bd1f49562ba7 # v1.6.29
         with:
           version: ${{ env.MELANGE_VERSION }}
 
       - name: Generate ephemeral signing key
-        uses: chainguard-dev/actions/melange-keygen@fabe4ed3f66ceb5f8ec86ed7ae6d0c945ca362fb # v1.6.28
+        uses: chainguard-dev/actions/melange-keygen@b2555de0cf9724fb9b49d050ff18bd1f49562ba7 # v1.6.29
         with:
           signing-key-path: ${{ github.workspace }}/melange.rsa
 
@@ -467,7 +467,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install melange
-        uses: chainguard-dev/actions/setup-melange@fabe4ed3f66ceb5f8ec86ed7ae6d0c945ca362fb # v1.6.28
+        uses: chainguard-dev/actions/setup-melange@b2555de0cf9724fb9b49d050ff18bd1f49562ba7 # v1.6.29
         with:
           version: ${{ env.MELANGE_VERSION }}
 
@@ -475,7 +475,7 @@ jobs:
 
       - name: Log in to Container Registry
         if: github.event_name != 'pull_request'
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 # v4.5.1
         with:
           registry: ${{ env.REGISTRY_HOST }}
           username: ${{ github.actor }}