diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml
index 95ef4188..5451e0ea 100644
--- a/.github/workflows/auto-merge.yml
+++ b/.github/workflows/auto-merge.yml
@@ -23,7 +23,7 @@ jobs:
     permissions:
       contents: write
       pull-requests: write
-    uses: go-openapi/ci-workflows/.github/workflows/auto-merge.yml@af4c93f45481ea7d24ac2a9858272cc03daf424e # v0.4.0
+    uses: go-openapi/ci-workflows/.github/workflows/auto-merge.yml@20153976c20b55ce3289b6f9cf36c7149d3f1fff # v0.4.2
     with:
       enable-organization-bot: "false"
 
@@ -48,13 +48,13 @@ jobs:
     steps:
       -
         name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Auto-approve PR
         run: gh pr review --approve "$PR_URL"
       -
         name: Wait for all workflow runs to complete
-        uses: go-openapi/gh-actions/ci-jobs/wait-pending-jobs@b0542d87f701a2fdba9629421026a2bdd54e2859 # v1.4.15
+        uses: go-openapi/gh-actions/ci-jobs/wait-pending-jobs@8dac43b693193389fbdb110e0c39aa013ae089ef # v1.4.16
         with:
           pr-url: ${{ env.PR_URL }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 8bc28c04..543fca8c 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -21,4 +21,4 @@ jobs:
     permissions:
       contents: read
       security-events: write
-    uses: go-openapi/ci-workflows/.github/workflows/codeql.yml@af4c93f45481ea7d24ac2a9858272cc03daf424e # v0.4.0
+    uses: go-openapi/ci-workflows/.github/workflows/codeql.yml@20153976c20b55ce3289b6f9cf36c7149d3f1fff # v0.4.2
diff --git a/.github/workflows/contributors.yml b/.github/workflows/contributors.yml
index 1cd70058..7286e120 100644
--- a/.github/workflows/contributors.yml
+++ b/.github/workflows/contributors.yml
@@ -17,7 +17,7 @@ jobs:
     permissions:
       pull-requests: write
       contents: write
-    uses: go-openapi/ci-workflows/.github/workflows/contributors.yml@af4c93f45481ea7d24ac2a9858272cc03daf424e # v0.4.0
+    uses: go-openapi/ci-workflows/.github/workflows/contributors.yml@20153976c20b55ce3289b6f9cf36c7149d3f1fff # v0.4.2
     secrets:
       github-app-id: ${{ secrets.CI_BOT_APP_ID }}
       github-app-private-key: ${{ secrets.CI_BOT_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/go-test.yml b/.github/workflows/go-test.yml
index bbafda6c..59d9328f 100644
--- a/.github/workflows/go-test.yml
+++ b/.github/workflows/go-test.yml
@@ -14,7 +14,7 @@ jobs:
     name: lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.ref }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
@@ -46,7 +46,7 @@ jobs:
           - windows-latest
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.ref }}
           repository: ${{ github.event.pull_request.head.repo.full_name }}
diff --git a/.github/workflows/regen.yml b/.github/workflows/regen.yml
index 0e90d4b0..06634dd5 100644
--- a/.github/workflows/regen.yml
+++ b/.github/workflows/regen.yml
@@ -21,10 +21,10 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       -
         name: Configure bot credentials
-        uses: go-openapi/gh-actions/ci-jobs/bot-credentials@b0542d87f701a2fdba9629421026a2bdd54e2859 # v1.4.15
+        uses: go-openapi/gh-actions/ci-jobs/bot-credentials@8dac43b693193389fbdb110e0c39aa013ae089ef # v1.4.16
         id: bot-credentials
         with:
           enable-github-app: "true"
diff --git a/.github/workflows/scanner.yml b/.github/workflows/scanner.yml
index 6836acab..24ab272c 100644
--- a/.github/workflows/scanner.yml
+++ b/.github/workflows/scanner.yml
@@ -18,4 +18,4 @@ jobs:
     permissions:
       contents: read
       security-events: write
-    uses: go-openapi/ci-workflows/.github/workflows/scanner.yml@af4c93f45481ea7d24ac2a9858272cc03daf424e # v0.4.0
+    uses: go-openapi/ci-workflows/.github/workflows/scanner.yml@20153976c20b55ce3289b6f9cf36c7149d3f1fff # v0.4.2
diff --git a/.github/workflows/update-doc.yml b/.github/workflows/update-doc.yml
index 0eb3fecc..41df696a 100644
--- a/.github/workflows/update-doc.yml
+++ b/.github/workflows/update-doc.yml
@@ -36,7 +36,7 @@ jobs:
     steps:
       -
         name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: '1'
           submodules: recursive