diff --git a/.github/workflows/pull_request_label.yml b/.github/workflows/pull_request_label.yml
index 9be2e1d61cd1..23a6ecc8ec40 100644
--- a/.github/workflows/pull_request_label.yml
+++ b/.github/workflows/pull_request_label.yml
@@ -21,7 +21,7 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d
+      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"
           sync-labels: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 81fe26f55830..a419286b8992 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -41,7 +41,7 @@ jobs:
     # because there doesn't appear to be anything to wait for. To avoid that,
     # explicitly wait for one LUCI test by name first.
     - name: Wait for test check-in
-      uses: lewagon/wait-on-check-action@96d9100b431964d10e0136aff8b9ccb92470505e
+      uses: lewagon/wait-on-check-action@2271c86c146b96545b4e871b855e10ffa6f50773
       with:
         ref: ${{ github.sha }}
         check-name: 'Linux ci_yaml packages roller'
@@ -53,7 +53,7 @@ jobs:
 
     # This workflow should be the last to run. So wait for all the other tests to succeed.
     - name: Wait on all tests
-      uses: lewagon/wait-on-check-action@96d9100b431964d10e0136aff8b9ccb92470505e
+      uses: lewagon/wait-on-check-action@2271c86c146b96545b4e871b855e10ffa6f50773
       with:
         ref: ${{ github.sha }}
         running-workflow-name: 'release'
diff --git a/.github/workflows/reusable_release.yml b/.github/workflows/reusable_release.yml
index 1bbe4d6b548e..09ca307647c8 100644
--- a/.github/workflows/reusable_release.yml
+++ b/.github/workflows/reusable_release.yml
@@ -51,7 +51,7 @@ jobs:
     # explicitly wait for one LUCI test by name first.
     - name: Wait for test check-in
       if: inputs.branch-name == 'main'
-      uses: lewagon/wait-on-check-action@96d9100b431964d10e0136aff8b9ccb92470505e
+      uses: lewagon/wait-on-check-action@2271c86c146b96545b4e871b855e10ffa6f50773
       with:
         ref: ${{ github.sha }}
         check-name: 'Linux ci_yaml packages roller'
@@ -64,7 +64,7 @@ jobs:
     # This workflow should be the last to run. So wait for all the other tests to succeed.
     - name: Wait on all tests
       if: inputs.branch-name == 'main'
-      uses: lewagon/wait-on-check-action@96d9100b431964d10e0136aff8b9ccb92470505e
+      uses: lewagon/wait-on-check-action@2271c86c146b96545b4e871b855e10ffa6f50773
       with:
         ref: ${{ github.sha }}
         running-workflow-name: 'release'