diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 66b5b408..0c04894b 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -79,7 +79,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+      uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -105,6 +105,6 @@ jobs:
         exit 1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+      uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
       with:
         category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/fork-coverage.yml b/.github/workflows/fork-coverage.yml
index 4c80988a..d479a6b8 100644
--- a/.github/workflows/fork-coverage.yml
+++ b/.github/workflows/fork-coverage.yml
@@ -29,7 +29,7 @@ jobs:
       CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
     steps:
       - name: Download coverage payload from CI run
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: codecov-payload
           path: codecov-payload
diff --git a/.github/workflows/fork-sonar.yml b/.github/workflows/fork-sonar.yml
index a7df4973..e930fd15 100644
--- a/.github/workflows/fork-sonar.yml
+++ b/.github/workflows/fork-sonar.yml
@@ -47,7 +47,7 @@ jobs:
       - name: Download successful fork PR analysis inputs
         # Store outside the workspace so the later checkout (which cleans the
         # workspace) does not remove these files.
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: sonar-analysis-inputs
           path: ${{ runner.temp }}/sonar-analysis-data
diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index 1bc5415b..287e076a 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -119,7 +119,7 @@ jobs:
 
     - name: Upload Sonar analysis inputs (fork PRs)
       if: always() && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
         name: sonar-analysis-inputs
         path: sonar-analysis-data/
@@ -135,7 +135,7 @@ jobs:
 
     - name: Upload JaCoCo HTML report (processor)
       if: always()
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
         name: jacoco-report-html-processor
         path: processor/target/site/jacoco/
@@ -143,7 +143,7 @@ jobs:
 
     - name: Upload JaCoCo XML report (processor)
       if: always()
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
         name: jacoco-report-xml-processor
         path: processor/target/site/jacoco/jacoco.xml
@@ -176,7 +176,7 @@ jobs:
 
     - name: Upload Codecov payload artifact (fork PRs)
       if: always() && github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
         name: codecov-payload
         path: codecov-payload/