diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index fcdd892..01e123b 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+      - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           languages: rust
-      - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+      - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c5606a1..4b10ac6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -71,7 +71,7 @@ jobs:
           cp "target/${{ matrix.target }}/release/eval_split_guard${{ matrix.ext }}" staging/
           cp README.md README.zh-CN.md CHANGELOG.md LICENSE staging/
           tar -czf "dist/eval_split_guard-${GITHUB_REF_NAME}-${{ matrix.target }}.tar.gz" -C staging .
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with: { name: "eval_split_guard-${{ matrix.target }}", path: "dist/*", if-no-files-found: error, retention-days: 7 }
   evidence:
     needs: validate
@@ -89,7 +89,7 @@ jobs:
           mv eval_split_guard.cdx.json dist/SBOM.cdx.json
           cargo metadata --locked --format-version 1 | jq '[.packages[] | {name, version, license}]' > dist/LICENSES.json
           jq -n --arg repository "${GITHUB_REPOSITORY}" --arg sha "${GITHUB_SHA}" --arg tag "${GITHUB_REF_NAME}" '{schema_version:1,repository:$repository,commit:$sha,tag:$tag}' > dist/RELEASE_EVIDENCE.json
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with: { name: eval_split_guard-evidence, path: "dist/*", if-no-files-found: error, retention-days: 7 }
   publish:
     needs: [build, evidence]
@@ -98,7 +98,7 @@ jobs:
     timeout-minutes: 15
     permissions: { contents: write, id-token: write, attestations: write }
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with: { path: dist, merge-multiple: true }
       - name: Verify assets and checksums
         shell: bash