diff --git a/.github/workflows/boilerplate.yaml b/.github/workflows/boilerplate.yaml
index 312f6c6..ee50a8e 100644
--- a/.github/workflows/boilerplate.yaml
+++ b/.github/workflows/boilerplate.yaml
@@ -47,7 +47,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: chainguard-dev/actions/boilerplate@4d37df0d85a91f619edc34a8803323033cdcb124 # v1.6.27
+      - uses: chainguard-dev/actions/boilerplate@fabe4ed3f66ceb5f8ec86ed7ae6d0c945ca362fb # v1.6.28
         with:
           extension: ${{ matrix.extension }}
           language: ${{ matrix.language }}
diff --git a/.github/workflows/donotsubmit.yaml b/.github/workflows/donotsubmit.yaml
index b2837c4..78a56d3 100644
--- a/.github/workflows/donotsubmit.yaml
+++ b/.github/workflows/donotsubmit.yaml
@@ -31,4 +31,4 @@ jobs:
           persist-credentials: false
 
       - name: Do Not Submit
-        uses: chainguard-dev/actions/donotsubmit@4d37df0d85a91f619edc34a8803323033cdcb124 # v1.6.27
+        uses: chainguard-dev/actions/donotsubmit@fabe4ed3f66ceb5f8ec86ed7ae6d0c945ca362fb # v1.6.28
diff --git a/.github/workflows/style.yaml b/.github/workflows/style.yaml
index a47ab9f..e711564 100644
--- a/.github/workflows/style.yaml
+++ b/.github/workflows/style.yaml
@@ -36,7 +36,7 @@ jobs:
           go-version-file: './go.mod'
           check-latest: true
 
-      - uses: chainguard-dev/actions/gofmt@4d37df0d85a91f619edc34a8803323033cdcb124 # v1.6.27
+      - uses: chainguard-dev/actions/gofmt@fabe4ed3f66ceb5f8ec86ed7ae6d0c945ca362fb # v1.6.28
         with:
           args: -s
 
@@ -64,7 +64,7 @@ jobs:
           go-version-file: './go.mod'
           check-latest: true
 
-      - uses: chainguard-dev/actions/goimports@4d37df0d85a91f619edc34a8803323033cdcb124 # v1.6.27
+      - uses: chainguard-dev/actions/goimports@fabe4ed3f66ceb5f8ec86ed7ae6d0c945ca362fb # v1.6.28
 
   golangci-lint:
     name: golangci-lint
@@ -122,10 +122,10 @@ jobs:
           check-latest: true
           cache: false
 
-      - uses: chainguard-dev/actions/trailing-space@4d37df0d85a91f619edc34a8803323033cdcb124 # v1.6.27
+      - uses: chainguard-dev/actions/trailing-space@fabe4ed3f66ceb5f8ec86ed7ae6d0c945ca362fb # v1.6.28
         if: ${{ always() }}
 
-      - uses: chainguard-dev/actions/eof-newline@4d37df0d85a91f619edc34a8803323033cdcb124 # v1.6.27
+      - uses: chainguard-dev/actions/eof-newline@fabe4ed3f66ceb5f8ec86ed7ae6d0c945ca362fb # v1.6.28
         if: ${{ always() }}
 
       - uses: step-security/action-tflint@285fe25934512644274b253b424a5d4b8f1c2dc5 # v1.25.0
diff --git a/.github/workflows/verify.yaml b/.github/workflows/verify.yaml
index eec37d8..cd2d663 100644
--- a/.github/workflows/verify.yaml
+++ b/.github/workflows/verify.yaml
@@ -62,7 +62,7 @@ jobs:
         ./hack/update-codegen.sh
 
     - name: Verify
-      uses: chainguard-dev/actions/nodiff@4d37df0d85a91f619edc34a8803323033cdcb124 # v1.6.27
+      uses: chainguard-dev/actions/nodiff@fabe4ed3f66ceb5f8ec86ed7ae6d0c945ca362fb # v1.6.28
       with:
         path: ./src/github.com/${{ github.repository }}
         fixup-command: "./hack/update-codegen.sh"
diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml
index b97d63f..1329a44 100644
--- a/.github/workflows/zizmor.yaml
+++ b/.github/workflows/zizmor.yaml
@@ -39,4 +39,4 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@6599ee8b7a49aef6a770f63d261d214911a7ce02 # v0.6.0
+        uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1