diff --git a/.github/workflows/ci-container.yml b/.github/workflows/ci-container.yml
index 9f6a3fc77ab..9e493a392be 100644
--- a/.github/workflows/ci-container.yml
+++ b/.github/workflows/ci-container.yml
@@ -34,7 +34,7 @@ jobs:
           distribution: temurin
           java-version: '21'
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3  # v4
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8  # v4
         with:
           platforms: linux/amd64,linux/arm64
       - name: Enable containerd image store
@@ -44,7 +44,7 @@ jobs:
       - name: Verify containerd snapshotter is active
         run: docker info -f '{{.DriverStatus}}'
       - name: Make buildkit default
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5  # v4
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c  # v4
         with:
           driver: docker
         id: buildx
diff --git a/.github/workflows/ci-release.yml b/.github/workflows/ci-release.yml
index 8e4845411b7..99b7eb19140 100644
--- a/.github/workflows/ci-release.yml
+++ b/.github/workflows/ci-release.yml
@@ -368,7 +368,7 @@ jobs:
       - name: List release assets
         run: ls -lh /tmp/release-assets/
 
-      - uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b  # v3.0.1
+      - uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228  # v3.0.2
         with:
           tag_name: ${{ github.event.inputs.tag || github.ref_name }}
           files: /tmp/release-assets/*