diff --git a/.github/workflows/linter.yml b/.github/workflows/linter.yml
index cf707111..b1ff3d72 100644
--- a/.github/workflows/linter.yml
+++ b/.github/workflows/linter.yml
@@ -105,11 +105,11 @@ jobs:
     steps:
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
-      - uses: github/codeql-action/init@96f518a34f7a870018057716cc4d7a5c014bd61c # v3.29.10
+      - uses: github/codeql-action/init@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3
         with:
           languages: ${{ matrix.language }}
 
-      - uses: github/codeql-action/analyze@96f518a34f7a870018057716cc4d7a5c014bd61c # v3.29.10
+      - uses: github/codeql-action/analyze@192325c86100d080feab897ff886c34abd4c83a3 # v3.30.3
         with:
           category: "/language:${{matrix.language}}"
 
@@ -123,14 +123,14 @@ jobs:
           fetch-depth: "${{ inputs.lint-all && 1 || 0 }}"
 
       - id: changed-files
-        uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c # v46.0.5
+        uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0
         if: ${{ inputs.lint-all == false }}
         with:
           files: ${{ inputs.action-files }}
           dir_names_exclude_current_dir: true
 
       - id: get-files-to-lint
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const fs = require("node:fs");
diff --git a/.github/workflows/semantic-pull-request.yml b/.github/workflows/semantic-pull-request.yml
index 0c1ed2d0..5d49d8b6 100644
--- a/.github/workflows/semantic-pull-request.yml
+++ b/.github/workflows/semantic-pull-request.yml
@@ -39,6 +39,6 @@ jobs:
     name: "☑️ Validate PR title"
     runs-on: ${{ inputs.runs-on && fromJson(inputs.runs-on) || 'ubuntu-latest' }}
     steps:
-      - uses: amannn/action-semantic-pull-request@7f33ba792281b034f64e96f4c0b5496782dd3b37 # v6.1.0
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
         env:
           GITHUB_TOKEN: ${{ secrets.github-token || github.token }}
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 7d6380c2..5425eb94 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -50,7 +50,7 @@ jobs:
     runs-on: ${{ inputs.runs-on && fromJson(inputs.runs-on) || 'ubuntu-latest' }}
 
     steps:
-      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9.1.0
+      - uses: actions/stale@3a9db7e6a41a89f618792c92c0e97cc736e1b13f # v10.0.0
         with:
           stale-issue-message: ${{ inputs.stale-issue-message || 'This issue is stale' }}
           stale-pr-message: ${{ inputs.stale-pr-message || 'This PR is stale' }}