diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 2d9e2a3ba3..bb1f45dd60 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -58,7 +58,7 @@ jobs:
           SENTRY_PROJECT: sentry-android
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # pin@v4
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # pin@v4
         with:
           name: sentry-java
           fail_ci_if_error: false
diff --git a/.github/workflows/changelog-preview.yml b/.github/workflows/changelog-preview.yml
index 612cc5b52f..ad0c577b29 100644
--- a/.github/workflows/changelog-preview.yml
+++ b/.github/workflows/changelog-preview.yml
@@ -15,5 +15,5 @@ permissions:
 
 jobs:
   changelog-preview:
-    uses: getsentry/craft/.github/workflows/changelog-preview.yml@4468eb9e399655a61c770534dacc03139d98aa18 # v2
+    uses: getsentry/craft/.github/workflows/changelog-preview.yml@6143e76379c342e247687c4ab5c83d8b900cc273 # v2
     secrets: inherit
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a6964cec4b..36732d3874 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -34,7 +34,7 @@ jobs:
           fetch-depth: 0
           submodules: 'recursive'
       - name: Prepare release
-        uses: getsentry/craft@4468eb9e399655a61c770534dacc03139d98aa18 # v2
+        uses: getsentry/craft@6143e76379c342e247687c4ab5c83d8b900cc273 # v2
         env:
           GITHUB_TOKEN: ${{ steps.token.outputs.token }}
         with: