diff --git a/.github/workflows/build-forge-github-app-register.yml b/.github/workflows/build-forge-github-app-register.yml
index 5bc85803b..6c82f05c6 100644
--- a/.github/workflows/build-forge-github-app-register.yml
+++ b/.github/workflows/build-forge-github-app-register.yml
@@ -54,7 +54,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
         with:
           platforms: ${{ env.PLATFORMS }}
 
diff --git a/.github/workflows/build-pre-commit.yml b/.github/workflows/build-pre-commit.yml
index 9bea6d4b1..d25ceb952 100644
--- a/.github/workflows/build-pre-commit.yml
+++ b/.github/workflows/build-pre-commit.yml
@@ -54,7 +54,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003 # v4.4.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
         with:
           platforms: ${{ env.PLATFORMS }}
 
diff --git a/.github/workflows/iac-policy.yml b/.github/workflows/iac-policy.yml
index ec9c1569d..b677a130a 100644
--- a/.github/workflows/iac-policy.yml
+++ b/.github/workflows/iac-policy.yml
@@ -384,6 +384,6 @@ jobs:
       - name: Upload Checkov SARIF
         if: always()
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/infrascan-security-audit.yml b/.github/workflows/infrascan-security-audit.yml
index a93159160..dd95a158e 100644
--- a/.github/workflows/infrascan-security-audit.yml
+++ b/.github/workflows/infrascan-security-audit.yml
@@ -52,7 +52,7 @@ jobs:
             ./ .infrascan-src/
 
       - name: Run InfraScan
-        uses: soldevelo/infrascan@7b56a90270606fa298aec4c82a93d0cd99f5d454 # v1.2.0
+        uses: soldevelo/infrascan@d014b41beb18257680965b5c07d9d53de53bc042 # v1.2.2
         with:
           directory: .infrascan-src
           scanner: comprehensive
@@ -61,7 +61,7 @@ jobs:
           fail-on: high_critical
 
       - name: Upload HTML report
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: infrascan-report
diff --git a/.github/workflows/lambda-tests.yml b/.github/workflows/lambda-tests.yml
index 4fa40d39b..a688c3231 100644
--- a/.github/workflows/lambda-tests.yml
+++ b/.github/workflows/lambda-tests.yml
@@ -88,7 +88,7 @@ jobs:
 
       - name: Upload coverage
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: lambda-test-results
           path: |
diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml
index fac59e1da..fbf6a3d0a 100644
--- a/.github/workflows/ossf-scorecard.yml
+++ b/.github/workflows/ossf-scorecard.yml
@@ -47,13 +47,13 @@ jobs:
           results_format: sarif
 
       - name: Upload artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
 
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 0b9f3c299..e9aadc1e0 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -67,7 +67,7 @@ jobs:
 
       - name: Upload pre-commit log
         if: failure()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: pre-commit-log
           path: pre-commit.log
diff --git a/docs/operations/repo-blueprints/reusable-actions/.github/actions/terragrunt-deployment-action/action.yml b/docs/operations/repo-blueprints/reusable-actions/.github/actions/terragrunt-deployment-action/action.yml
index fa1dde291..d84a358c7 100644
--- a/docs/operations/repo-blueprints/reusable-actions/.github/actions/terragrunt-deployment-action/action.yml
+++ b/docs/operations/repo-blueprints/reusable-actions/.github/actions/terragrunt-deployment-action/action.yml
@@ -61,7 +61,7 @@ runs:
         role-skip-session-tagging: true
 
     - name: Retrieve Secrets from AWS Secrets Manager
-      uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1
+      uses: aws-actions/aws-secretsmanager-get-secrets@2297f9a879480a9e3af9b293ed15c70caf8e1c88 # v3.0.2
       with:
         secret-ids: |
           GITHUB_APP_AUTOMATION,/cicd/common/github_app_automation
diff --git a/docs/operations/repo-blueprints/reusable-actions/.github/actions/toggle-workflows-action/action.yml b/docs/operations/repo-blueprints/reusable-actions/.github/actions/toggle-workflows-action/action.yml
index 2f469daba..7d9a64e10 100644
--- a/docs/operations/repo-blueprints/reusable-actions/.github/actions/toggle-workflows-action/action.yml
+++ b/docs/operations/repo-blueprints/reusable-actions/.github/actions/toggle-workflows-action/action.yml
@@ -41,7 +41,7 @@ runs:
         role-skip-session-tagging: true
 
     - name: Retrieve Secrets from AWS Secrets Manager
-      uses: aws-actions/aws-secretsmanager-get-secrets@2cb1a461cbd4865ac4299648312e4704c646cd53 # v3.0.1
+      uses: aws-actions/aws-secretsmanager-get-secrets@2297f9a879480a9e3af9b293ed15c70caf8e1c88 # v3.0.2
       with:
         secret-ids: |
           GITHUB_APP_AUTOMATION,/cicd/common/github_app_automation