diff --git a/.github/workflows/binaries.yml b/.github/workflows/binaries.yml
index a5bbdc80a..ec75dcaca 100644
--- a/.github/workflows/binaries.yml
+++ b/.github/workflows/binaries.yml
@@ -72,7 +72,7 @@ jobs:
 
     - name: Attest build provenance
       if: ${{ github.event_name == 'release' }}
-      uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4.1.0
+      uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4.1.1
       with:
         subject-path: dist/${{ steps.build.outputs.ARCHIVE_FILE }}
 
diff --git a/.github/workflows/snap.yml b/.github/workflows/snap.yml
index d92182381..46598e862 100644
--- a/.github/workflows/snap.yml
+++ b/.github/workflows/snap.yml
@@ -107,7 +107,7 @@ jobs:
 
       - name: Attest build provenance
         if: steps.build-snap.outcome == 'success'
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  # v4.1.0
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373  # v4.1.1
         with:
           subject-path: ${{ steps.build-snap.outputs.snap }}
 
diff --git a/.github/workflows/tiobe.yaml b/.github/workflows/tiobe.yaml
index e18981477..02ad83255 100644
--- a/.github/workflows/tiobe.yaml
+++ b/.github/workflows/tiobe.yaml
@@ -36,7 +36,7 @@ jobs:
           gocov-xml < coverage.json > .coverage/coverage.xml
 
       - name: TICS GitHub Action
-        uses: tiobe/tics-github-action@3300ccc8de3c938cb83dc940ec4d07096c1bf185  # 3.9.1
+        uses: tiobe/tics-github-action@016a4d79f3027fe7b4a2901619a58c745ab7cadf  # 3.10.0
         with:
           mode: qserver
           viewerUrl: https://canonical.tiobe.com/tiobeweb/TICS/api/cfg?name=GoProjects
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 16c9b8366..c7a838e77 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -28,7 +28,7 @@ jobs:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@v4.36.2
         with:
           sarif_file: results.sarif
           category: zizmor