diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index c262964a1e..d2cfc91e28 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -32,17 +32,17 @@ jobs:
     env:
       JAVA_OPTS: "-XX:+TieredCompilation -XX:TieredStopAtLevel=1"
     steps:
-    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
     - name: Set up JDK (without deployment credentials)
       if: ${{ github.event_name == 'pull_request' || github.repository != 'FasterXML/jackson-core' }}
-      uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
       with:
         distribution: 'temurin'
         java-version: ${{ matrix.java_version }}
         cache: 'maven'
     - name: Set up JDK with deployment credentials
       if: ${{ github.event_name != 'pull_request' && github.repository == 'FasterXML/jackson-core' }}
-      uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
       with:
         distribution: 'temurin'
         java-version: ${{ matrix.java_version }}
@@ -75,7 +75,7 @@ jobs:
       run: ./mvnw -B -q -ff -ntp test jacoco:report
     - name: Publish code coverage
       if: ${{ matrix.release_build && github.event_name != 'pull_request' && github.repository == 'FasterXML/jackson-core' }}
-      uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+      uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
       with:
         token: ${{ secrets.CODECOV_TOKEN }}
         files: ./target/site/jacoco/jacoco.xml
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index cda65bc6e8..1cc640837f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -31,9 +31,9 @@ jobs:
       - name: Validate version name
         run: |
           [[ "$TAG" =~ jackson-core-[0-9]+\.[0-9]+\.[0-9]+(-rc[0-9]+)? ]] || exit 1
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Set up JDK
-        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
         with:
           distribution: "temurin"
           java-version: "8"
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 2e1b3618b7..fcba86c0d4 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -29,7 +29,7 @@ jobs:
 
     steps:
       - name: "Checkout code"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
@@ -60,6 +60,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@87557b9c84dde89fdd9b10e88954ac2f4248e463 # v3.29.5
+        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v3.29.5
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/trigger_dep_builds_v2.yml b/.github/workflows/trigger_dep_builds_v2.yml
index 4ba3a5b7eb..a1615d178c 100644
--- a/.github/workflows/trigger_dep_builds_v2.yml
+++ b/.github/workflows/trigger_dep_builds_v2.yml
@@ -23,7 +23,7 @@ jobs:
 
     steps:
       - name: Repository dispatch
-        uses: peter-evans/repository-dispatch@0e0cf047c08f936c436da4399814cdb4880c8cbf # v3.0.0
+        uses: peter-evans/repository-dispatch@428de239af282baa9ed57c8003ca2082586703c3 # v3.0.0
         with:
           token: ${{ secrets.token }}
           repository: ${{ matrix.repo }}
diff --git a/.github/workflows/trigger_dep_builds_v3.yml b/.github/workflows/trigger_dep_builds_v3.yml
index 4a9526ea52..74d9380024 100644
--- a/.github/workflows/trigger_dep_builds_v3.yml
+++ b/.github/workflows/trigger_dep_builds_v3.yml
@@ -23,7 +23,7 @@ jobs:
 
     steps:
       - name: Repository dispatch
-        uses: peter-evans/repository-dispatch@0e0cf047c08f936c436da4399814cdb4880c8cbf # v3.0.0
+        uses: peter-evans/repository-dispatch@428de239af282baa9ed57c8003ca2082586703c3 # v3.0.0
         with:
           token: ${{ secrets.token }}
           repository: ${{ matrix.repo }}
diff --git a/.github/workflows/update-readme-version.yml b/.github/workflows/update-readme-version.yml
index d56bffdb64..ebff2a3c45 100644
--- a/.github/workflows/update-readme-version.yml
+++ b/.github/workflows/update-readme-version.yml
@@ -19,7 +19,7 @@ jobs:
   update-readme:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           ref: 3.x
       - name: Extract version from tag