diff --git a/.github/workflows/casket-ci.yml b/.github/workflows/casket-ci.yml
index 2dc4183..fa6a1df 100644
--- a/.github/workflows/casket-ci.yml
+++ b/.github/workflows/casket-ci.yml
@@ -31,7 +31,7 @@ jobs:
           enable-stack: true
           stack-version: 'latest'
       - name: Cache Stack dependencies
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v4
         with:
           path: |
             ~/.stack
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4f3350e..052d813 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,7 +23,7 @@ jobs:
           ghc-version: '9.4'
           cabal-version: '3.10'
       - name: Cache Cabal
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v4
         with:
           path: |
             ~/.cabal/packages
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 5df2fdf..b6a81ff 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -24,7 +24,7 @@ jobs:
           ghc-version: '9.8.2'
           cabal-version: '3.10'
       - name: Cache Cabal
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v4
         with:
           path: |
             ~/.cabal/packages
diff --git a/.github/workflows/push-email-notify.yml b/.github/workflows/push-email-notify.yml
index 4b4e754..9abf263 100644
--- a/.github/workflows/push-email-notify.yml
+++ b/.github/workflows/push-email-notify.yml
@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Send push notification email
-        uses: dawidd6/action-send-mail@6e502825a508b867ab2954ad6343b68787624c01 # pinned
+        uses: dawidd6/action-send-mail@994f270325d4f7257aff241a35488ef54ba364a4 # pinned
         with:
           server_address: ${{ secrets.SMTP_HOST }}
           server_port: ${{ secrets.SMTP_PORT }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 62109a9..84ba490 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -44,7 +44,7 @@ jobs:
           ghc-version: '9.8'
           cabal-version: '3.12'
       - name: Cache Cabal
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cabal/packages
@@ -134,7 +134,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
         with:
           subject-path: |
             artifacts/*.tar.gz