diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3f4540b..afa1052 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -70,7 +70,7 @@ jobs:
           persist-credentials: false
 
       - name: Install uv
-        uses: astral-sh/setup-uv@ae62891fec2bb8e7d6c99fc78c9fec3a63790f8d # v10.0.0
+        uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
 
       - name: Run uv lock update tests
         run: |
diff --git a/codeql/action.yml b/codeql/action.yml
index ba4e476..071a5ac 100644
--- a/codeql/action.yml
+++ b/codeql/action.yml
@@ -38,7 +38,7 @@ runs:
         FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+      uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
       env:
         FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
       with:
@@ -61,12 +61,12 @@ runs:
 
     - if: ${{ inputs.build-mode == 'autobuild' }}
       name: Autobuild
-      uses: github/codeql-action/autobuild@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+      uses: github/codeql-action/autobuild@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
       env:
         FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+      uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
       env:
         FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
       with:
diff --git a/setup/action.yml b/setup/action.yml
index 53f016d..a20c316 100644
--- a/setup/action.yml
+++ b/setup/action.yml
@@ -33,7 +33,7 @@ runs:
     env:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
   - name: Log in to ECR
-    uses: aws-actions/amazon-ecr-login@d539f0932e70871a027e9d5a9d8fc38589180a64 # v2
+    uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2
     with:
       registries: "${{ inputs.ecr_registry_id }}"
     env: