diff --git a/.github/workflows/actionlint.yaml b/.github/workflows/actionlint.yaml
index e83dea00..05a1f03e 100644
--- a/.github/workflows/actionlint.yaml
+++ b/.github/workflows/actionlint.yaml
@@ -43,7 +43,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             -   name: "Harden Runner"
-                uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+                uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
                 with:
                     egress-policy: block
                     allowed-endpoints: >
@@ -66,7 +66,7 @@ jobs:
                     output: ${{ runner.temp }}/poutine.sarif
 
             -   name: "Upload poutine SARIF file"
-                uses: github/codeql-action/upload-sarif@d1ba80a13dd99fba24a470575428917156a28b43 # v4.37.5
+                uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
                 with:
                     sarif_file: ${{ runner.temp }}/poutine.sarif
                     category: poutine
diff --git a/.github/workflows/cibuild.yaml b/.github/workflows/cibuild.yaml
index c21b8708..1c731f63 100644
--- a/.github/workflows/cibuild.yaml
+++ b/.github/workflows/cibuild.yaml
@@ -66,7 +66,7 @@ jobs:
         runs-on: ${{ matrix.os }}
         steps:
             -   name: Harden Runner
-                uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+                uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
                 with:
                     disable-sudo-and-containers: true
                     egress-policy: block
diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml
index 3bd55dbd..1bbe2944 100644
--- a/.github/workflows/stale.yaml
+++ b/.github/workflows/stale.yaml
@@ -34,7 +34,7 @@ jobs:
         runs-on: 'ubuntu-latest'
         steps:
             -   name: Harden Runner
-                uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+                uses: step-security/harden-runner@b09bb98e06d4d774595224525879c09bc6e98c40 # v2.20.1
                 with:
                     disable-sudo-and-containers: true
                     egress-policy: block