diff --git a/.github/workflows/atmos-pro.yaml b/.github/workflows/atmos-pro.yaml
index dca71cda7e..f6815be951 100644
--- a/.github/workflows/atmos-pro.yaml
+++ b/.github/workflows/atmos-pro.yaml
@@ -27,7 +27,7 @@ jobs:
       id-token: write
     timeout-minutes: 15
     steps:
-      - uses: runs-on/action@4e5f72399b6b17f2e79c511c1b38a315a64d22dc # v2.2.0
+      - uses: runs-on/action@46910bf61b41721b0579f237e186afb35477007a # v2.3.0
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 0
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index a08e92b20c..f7bfd0ec2e 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -26,7 +26,7 @@ jobs:
       id-token: write
       contents: write
       pull-requests: write
-    uses: cloudposse/.github/.github/workflows/shared-release-branches.yml@49ac8cd5c4cf74abdbf24a80027cd3bde811133a # main
+    uses: cloudposse/.github/.github/workflows/shared-release-branches.yml@3911c663309ecdda30d8b8fcbec7bde19d1d6ddb # main
     secrets: inherit
 
   homebrew:
@@ -128,7 +128,7 @@ jobs:
 
       - name: "Upload Trivy scan results to code-scanning"
         if: always()
-        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           sarif_file: trivy-results.sarif
 
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index ee3e578a41..56a24dfcda 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -147,7 +147,7 @@ jobs:
 
       - name: Upload SARIF file
         if: always()
-        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           sarif_file: govulncheck.sarif
           category: govulncheck
@@ -187,7 +187,7 @@ jobs:
 
       - name: Upload SARIF to code-scanning
         if: always()
-        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           sarif_file: semgrep.sarif
           category: semgrep
diff --git a/.github/workflows/feature-release.yml b/.github/workflows/feature-release.yml
index bea60647ae..698f8b4350 100644
--- a/.github/workflows/feature-release.yml
+++ b/.github/workflows/feature-release.yml
@@ -23,7 +23,7 @@ jobs:
     # independent of which token is used for git/API calls elsewhere.
     permissions:
       id-token: write
-    uses: cloudposse/.github/.github/workflows/shared-go-auto-release.yml@49ac8cd5c4cf74abdbf24a80027cd3bde811133a # main
+    uses: cloudposse/.github/.github/workflows/shared-go-auto-release.yml@3911c663309ecdda30d8b8fcbec7bde19d1d6ddb # main
     with:
       publish: true
       prerelease: true
diff --git a/.github/workflows/landing-demos.yaml b/.github/workflows/landing-demos.yaml
index b4d0fee0e2..796dcb628c 100644
--- a/.github/workflows/landing-demos.yaml
+++ b/.github/workflows/landing-demos.yaml
@@ -48,7 +48,7 @@ jobs:
           go-version-file: go.mod
 
       - name: Set up Atmos
-        uses: cloudposse/github-action-setup-atmos@89c34b209108da66a27c8d6565d8d4b21dbdaa73 # v3.2.0
+        uses: cloudposse/github-action-setup-atmos@60878d48037763f759aedee74e9cc0c2dc88e9ec # v3.5.0
         with:
           atmos-version: ${{ env.ATMOS_BOOTSTRAP_VERSION }}
           install-wrapper: false
diff --git a/.github/workflows/nightlybuilds.yml b/.github/workflows/nightlybuilds.yml
index 9f653e0188..718b2ff774 100644
--- a/.github/workflows/nightlybuilds.yml
+++ b/.github/workflows/nightlybuilds.yml
@@ -21,7 +21,7 @@ permissions:
 
 jobs:
   release:
-    uses: cloudposse/.github/.github/workflows/shared-go-auto-release.yml@49ac8cd5c4cf74abdbf24a80027cd3bde811133a # main
+    uses: cloudposse/.github/.github/workflows/shared-go-auto-release.yml@3911c663309ecdda30d8b8fcbec7bde19d1d6ddb # main
     with:
       publish: true
       format: binary
diff --git a/.github/workflows/planfile-artifacts-e2e.yml b/.github/workflows/planfile-artifacts-e2e.yml
index e5bf24092d..0ba63c2eea 100644
--- a/.github/workflows/planfile-artifacts-e2e.yml
+++ b/.github/workflows/planfile-artifacts-e2e.yml
@@ -71,7 +71,7 @@ jobs:
           go-version-file: "go.mod"
 
       - name: Set up Atmos
-        uses: cloudposse/github-action-setup-atmos@89c34b209108da66a27c8d6565d8d4b21dbdaa73 # v3.2.0
+        uses: cloudposse/github-action-setup-atmos@60878d48037763f759aedee74e9cc0c2dc88e9ec # v3.5.0
         with:
           atmos-version: ${{ env.ATMOS_BOOTSTRAP_VERSION }}
           install-wrapper: false
@@ -113,7 +113,7 @@ jobs:
           go-version-file: "go.mod"
 
       - name: Set up Atmos
-        uses: cloudposse/github-action-setup-atmos@89c34b209108da66a27c8d6565d8d4b21dbdaa73 # v3.2.0
+        uses: cloudposse/github-action-setup-atmos@60878d48037763f759aedee74e9cc0c2dc88e9ec # v3.5.0
         with:
           atmos-version: ${{ env.ATMOS_BOOTSTRAP_VERSION }}
           install-wrapper: false
diff --git a/.github/workflows/planfile-verify-e2e.yml b/.github/workflows/planfile-verify-e2e.yml
index a4cc151365..97db263d99 100644
--- a/.github/workflows/planfile-verify-e2e.yml
+++ b/.github/workflows/planfile-verify-e2e.yml
@@ -73,7 +73,7 @@ jobs:
         with:
           go-version-file: "go.mod"
       - name: Set up Atmos
-        uses: cloudposse/github-action-setup-atmos@89c34b209108da66a27c8d6565d8d4b21dbdaa73 # v3.2.0
+        uses: cloudposse/github-action-setup-atmos@60878d48037763f759aedee74e9cc0c2dc88e9ec # v3.5.0
         with:
           atmos-version: ${{ env.ATMOS_BOOTSTRAP_VERSION }}
           install-wrapper: false
@@ -120,7 +120,7 @@ jobs:
         with:
           go-version-file: "go.mod"
       - name: Set up Atmos
-        uses: cloudposse/github-action-setup-atmos@89c34b209108da66a27c8d6565d8d4b21dbdaa73 # v3.2.0
+        uses: cloudposse/github-action-setup-atmos@60878d48037763f759aedee74e9cc0c2dc88e9ec # v3.5.0
         with:
           atmos-version: ${{ env.ATMOS_BOOTSTRAP_VERSION }}
           install-wrapper: false
@@ -159,7 +159,7 @@ jobs:
         with:
           go-version-file: "go.mod"
       - name: Set up Atmos
-        uses: cloudposse/github-action-setup-atmos@89c34b209108da66a27c8d6565d8d4b21dbdaa73 # v3.2.0
+        uses: cloudposse/github-action-setup-atmos@60878d48037763f759aedee74e9cc0c2dc88e9ec # v3.5.0
         with:
           atmos-version: ${{ env.ATMOS_BOOTSTRAP_VERSION }}
           install-wrapper: false
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index ae4f9f5651..c452300dc0 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -54,6 +54,6 @@ jobs:
           retention-days: 5
 
       - name: Upload to code-scanning
-        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/setup-go-cache-warmup.yml b/.github/workflows/setup-go-cache-warmup.yml
index 3ca3166829..3c4b399064 100644
--- a/.github/workflows/setup-go-cache-warmup.yml
+++ b/.github/workflows/setup-go-cache-warmup.yml
@@ -60,7 +60,7 @@ jobs:
         id: go
 
       - name: Set up Atmos
-        uses: cloudposse/github-action-setup-atmos@89c34b209108da66a27c8d6565d8d4b21dbdaa73 # v3.2.0
+        uses: cloudposse/github-action-setup-atmos@60878d48037763f759aedee74e9cc0c2dc88e9ec # v3.5.0
         with:
           atmos-version: ${{ env.ATMOS_BOOTSTRAP_VERSION }}
           install-wrapper: false
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 32953e15b7..5e61a43410 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -95,7 +95,7 @@ jobs:
         with:
           egress-policy: audit
 
-      - uses: runs-on/action@4e5f72399b6b17f2e79c511c1b38a315a64d22dc # v2.2.0
+      - uses: runs-on/action@46910bf61b41721b0579f237e186afb35477007a # v2.3.0
         if: matrix.target == 'linux'
 
       - name: Announce build target
@@ -416,7 +416,7 @@ jobs:
 
       - name: Check out code into the Go module directory
         if: ${{ ! ( matrix.flavor.target == 'windows' && github.event.pull_request.draft  ) }}
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
@@ -818,7 +818,7 @@ jobs:
 
       - name: Upload Trivy config scan results
         if: always()
-        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
+        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           sarif_file: trivy-config.sarif
           category: trivy-config
@@ -1538,7 +1538,7 @@ jobs:
     # endpoint, which is gated purely by this job's own id-token permission.
     permissions:
       id-token: write
-    uses: cloudposse/.github/.github/workflows/shared-go-auto-release.yml@49ac8cd5c4cf74abdbf24a80027cd3bde811133a # main
+    uses: cloudposse/.github/.github/workflows/shared-go-auto-release.yml@3911c663309ecdda30d8b8fcbec7bde19d1d6ddb # main
     with:
       publish: false
       format: binary
diff --git a/.github/workflows/version-tracker.yaml b/.github/workflows/version-tracker.yaml
index 5fed518b33..28b900538f 100644
--- a/.github/workflows/version-tracker.yaml
+++ b/.github/workflows/version-tracker.yaml
@@ -39,7 +39,7 @@ jobs:
           go-version-file: go.mod
 
       - name: Set up Atmos
-        uses: cloudposse/github-action-setup-atmos@89c34b209108da66a27c8d6565d8d4b21dbdaa73 # v3.2.0
+        uses: cloudposse/github-action-setup-atmos@60878d48037763f759aedee74e9cc0c2dc88e9ec # v3.5.0
         with:
           atmos-version: ${{ env.ATMOS_BOOTSTRAP_VERSION }}
           install-wrapper: false