diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fc01ce3..43587e0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,7 +16,7 @@ permissions: {}
 
 jobs:
   check:
-    uses: devenvy/ffmpeg-build/.github/workflows/check.yml@b28c4dd83afc3942aadbe6f7c6bf1f157e557a05 # v0.0.14
+    uses: devenvy/ffmpeg-build/.github/workflows/check.yml@6a896af714fafbfc2600fbdb646bab4c85215038 # v0.0.15
     permissions:
       contents: read
   # the workflows: actionlint (mistakes) and zizmor (GitHub Actions security)
@@ -32,7 +32,7 @@ jobs:
       - name: actionlint
         uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2.2.0
       - name: zizmor
-        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
         with:
           advanced-security: false # fail the job on findings instead of uploading SARIF
   # one check for the main ruleset to require, whatever ran
@@ -50,7 +50,7 @@ jobs:
         run: test "${CHECK}" = success && test "${LINT}" = success
   merge:
     needs: result
-    uses: devenvy/ffmpeg-build/.github/workflows/automerge.yml@b28c4dd83afc3942aadbe6f7c6bf1f157e557a05 # v0.0.14
+    uses: devenvy/ffmpeg-build/.github/workflows/automerge.yml@6a896af714fafbfc2600fbdb646bab4c85215038 # v0.0.15
     permissions:
       contents: write
       pull-requests: write
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 51df4f5..8e1394b 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -32,11 +32,11 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+      - uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           languages: ${{ matrix.language }}
           build-mode: none
           queries: security-and-quality
-      - uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+      - uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           category: /language:${{ matrix.language }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7a000fa..01aa915 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -12,7 +12,7 @@ permissions: {}
 
 jobs:
   release:
-    uses: devenvy/ffmpeg-build/.github/workflows/build.yml@b28c4dd83afc3942aadbe6f7c6bf1f157e557a05 # v0.0.14
+    uses: devenvy/ffmpeg-build/.github/workflows/build.yml@6a896af714fafbfc2600fbdb646bab4c85215038 # v0.0.15
     permissions:
       contents: write # the GitHub releases
     with:
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index e40c165..738b501 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -30,6 +30,6 @@ jobs:
           results_file: results.sarif
           results_format: sarif
           publish_results: true
-      - uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
+      - uses: github/codeql-action/upload-sarif@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4.39.0
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/update-lock.yml b/.github/workflows/update-lock.yml
index 3a1bae1..5bf31ec 100644
--- a/.github/workflows/update-lock.yml
+++ b/.github/workflows/update-lock.yml
@@ -14,7 +14,7 @@ permissions: {}
 
 jobs:
   update:
-    uses: devenvy/ffmpeg-build/.github/workflows/update-lock.yml@b28c4dd83afc3942aadbe6f7c6bf1f157e557a05 # v0.0.14
+    uses: devenvy/ffmpeg-build/.github/workflows/update-lock.yml@6a896af714fafbfc2600fbdb646bab4c85215038 # v0.0.15
     permissions:
       actions: write
       contents: write