diff --git a/.github/workflows/_lint.yml b/.github/workflows/_lint.yml
index 461786d..56fd7a7 100644
--- a/.github/workflows/_lint.yml
+++ b/.github/workflows/_lint.yml
@@ -7,7 +7,7 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - name: 🧹 lint yaml
         uses: ibiqlik/action-yamllint@v3
         with:
diff --git a/.github/workflows/_scorecard.yml b/.github/workflows/_scorecard.yml
index d889f34..a8cd8ff 100644
--- a/.github/workflows/_scorecard.yml
+++ b/.github/workflows/_scorecard.yml
@@ -20,7 +20,7 @@ jobs:
         id-token: write
         security-events: write
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: ✅ run scorecard analysis
@@ -31,12 +31,12 @@ jobs:
           repo_token: ${{ secrets.SCORECARD_TOKEN }}
           publish_results: ${{ inputs.publish-results }}
       - name: ⏫ upload sarif artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
       - name: 📦 upload sarif results
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/_stale.yml b/.github/workflows/_stale.yml
index 87712f8..cbcadc9 100644
--- a/.github/workflows/_stale.yml
+++ b/.github/workflows/_stale.yml
@@ -25,7 +25,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 📆 mark stale activity
-        uses: actions/stale@v10
+        uses: actions/stale@v11
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           days-before-stale: ${{ inputs.days-until-stale }}
diff --git a/.github/workflows/_sync.yml b/.github/workflows/_sync.yml
index 09c6bd9..0fe66ea 100644
--- a/.github/workflows/_sync.yml
+++ b/.github/workflows/_sync.yml
@@ -24,7 +24,7 @@ jobs:
   sync:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - name: 🔒 harden runner
         uses: step-security/harden-runner@v2
         with:
diff --git a/.github/workflows/clean-owners.yml b/.github/workflows/clean-owners.yml
index 9165f4f..8e2b13c 100644
--- a/.github/workflows/clean-owners.yml
+++ b/.github/workflows/clean-owners.yml
@@ -18,7 +18,7 @@ jobs:
         issues: write
     steps:
       - name: 🧼 clean codeowners
-        uses: github/cleanowners@7edc384737887977379590bb94b78ef26c5cffb1 # no semver release yet
+        uses: github/cleanowners@aea8fb15baf34300ef137f29eddbf19fe704bd74 # no semver release yet
         env:
           GH_TOKEN: ${{ secrets.CISCO_SERVICE_TOKEN }}
           ORGANIZATION: cisco-ospo
diff --git a/.github/workflows/contributor-report.yml b/.github/workflows/contributor-report.yml
index aa50428..8d63dca 100644
--- a/.github/workflows/contributor-report.yml
+++ b/.github/workflows/contributor-report.yml
@@ -40,7 +40,7 @@ jobs:
           echo "START_DATE=$START_DATE" >> "$GITHUB_ENV"
           echo "END_DATE=$END_DATE" >> "$GITHUB_ENV"
       - name: 📰 run contributors action
-        uses: github/contributors@b518e14609eadf468470392201312777172b5dec # v2.0.17
+        uses: github/contributors@6bab24b098e0b692d679d59f97d73b9297c96c18 # v2.0.21
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           START_DATE: ${{ env.START_DATE }}
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 194b7c8..e6479a5 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -18,7 +18,7 @@ jobs:
         uses: step-security/harden-runner@63c24ba6bd7ba022e95695ff85de572c04a18142 # v2.7.0
         with:
             egress-policy: audit
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: 🔂 dependency review
         uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
         with:
diff --git a/.github/workflows/scorecard-monitor.yml b/.github/workflows/scorecard-monitor.yml
index 041205e..5287548 100644
--- a/.github/workflows/scorecard-monitor.yml
+++ b/.github/workflows/scorecard-monitor.yml
@@ -29,7 +29,7 @@ jobs:
       # Required to create issues
       issues: write
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: 🔍 run scorecard monitor
         uses: ossf/scorecard-monitor@a3a9c4cfa0684480ec5f86fa178fc22c4394b69e # v2.0.0-beta8
         id: scorecard-monitor
diff --git a/.github/workflows/scorecard-test.yml b/.github/workflows/scorecard-test.yml
index 156651d..67298e5 100644
--- a/.github/workflows/scorecard-test.yml
+++ b/.github/workflows/scorecard-test.yml
@@ -26,7 +26,7 @@ jobs:
           app-id: ${{ secrets.GH_APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: ✅ run scorecard analysis
@@ -37,12 +37,12 @@ jobs:
           repo_token: ${{ steps.app-token.outputs.token }}
           publish_results: ${{ inputs.publish-results }}
       - name: ⏫ upload sarif artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: SARIF file
           path: results.sarif
           retention-days: 5
       - name: 📦 upload sarif results
-        uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
+        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           sarif_file: results.sarif