diff --git a/.github/workflows/sec-audit.yml b/.github/workflows/sec-audit.yml
index d108109..b93cf83 100644
--- a/.github/workflows/sec-audit.yml
+++ b/.github/workflows/sec-audit.yml
@@ -328,7 +328,7 @@ jobs:
 
             - name: Upload gitleaks SARIF
               if: always()
-              uses: github/codeql-action/upload-sarif@c793b717bc78562f491db7b0e93a3a178b099162 # v4
+              uses: github/codeql-action/upload-sarif@0d579ffd059c29b07949a3cce3983f0780820c98 # v4
               with:
                   sarif_file: artifacts/gitleaks.sarif
                   category: gitleaks
diff --git a/.github/workflows/sec-codeql.yml b/.github/workflows/sec-codeql.yml
index f846917..dfce50d 100644
--- a/.github/workflows/sec-codeql.yml
+++ b/.github/workflows/sec-codeql.yml
@@ -52,7 +52,7 @@ jobs:
                   fetch-depth: 0
 
             - name: Initialize CodeQL
-              uses: github/codeql-action/init@c793b717bc78562f491db7b0e93a3a178b099162 # v4
+              uses: github/codeql-action/init@0d579ffd059c29b07949a3cce3983f0780820c98 # v4
               with:
                   languages: rust
                   config-file: ./.github/codeql/codeql-config.yml
@@ -67,6 +67,6 @@ jobs:
               run: cargo build --workspace --all-targets --locked
 
             - name: Perform CodeQL Analysis
-              uses: github/codeql-action/analyze@c793b717bc78562f491db7b0e93a3a178b099162 # v4
+              uses: github/codeql-action/analyze@0d579ffd059c29b07949a3cce3983f0780820c98 # v4
               with:
                   category: "/language:rust"