diff --git a/.github/workflows/build-redoubt-image.yaml b/.github/workflows/build-redoubt-image.yaml
index 8b10a2d..baab47b 100644
--- a/.github/workflows/build-redoubt-image.yaml
+++ b/.github/workflows/build-redoubt-image.yaml
@@ -93,7 +93,7 @@ jobs:
     
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up QEMU (arm64 support)
         uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4
@@ -172,7 +172,7 @@ jobs:
 
       - name: Log podman into GHCR
         if: inputs.data-boundary && github.event_name != 'pull_request'
-        uses: redhat-actions/podman-login@v1
+        uses: redhat-actions/podman-login@50c2d9a331bb67c8fdab99b86455fad05e2e3252 # v2
         with:
           registry: ${{ inputs.registry }}
           username: ${{ github.actor }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 4d19994..b58011e 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -55,7 +55,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
     # Add any setup steps before running the `github/codeql-action/init` action.
     # This includes steps like installing compilers or runtimes (`actions/setup-node`