diff --git a/.github/workflows/catalog-index-sanity.yaml b/.github/workflows/catalog-index-sanity.yaml
index c7a24aeeed..12fb40bf4b 100644
--- a/.github/workflows/catalog-index-sanity.yaml
+++ b/.github/workflows/catalog-index-sanity.yaml
@@ -54,7 +54,7 @@ jobs:
     timeout-minutes: 60
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -63,14 +63,14 @@ jobs:
         run: corepack enable
 
       - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24
           cache: yarn
           cache-dependency-path: smoke-tests-native/yarn.lock
 
       - name: Setup Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
 
@@ -271,7 +271,7 @@ jobs:
       RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
@@ -289,7 +289,7 @@ jobs:
       # and an ImportError here means no issue is filed at all. Same pin and same
       # wheels-only install as the sanity job above.
       - name: Setup Python
-        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/notify-3rd-party-owners.yaml b/.github/workflows/notify-3rd-party-owners.yaml
index e81918dbf1..17d83e9a42 100644
--- a/.github/workflows/notify-3rd-party-owners.yaml
+++ b/.github/workflows/notify-3rd-party-owners.yaml
@@ -30,7 +30,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install js-yaml
         run: npm install --ignore-scripts js-yaml@4.3.1
diff --git a/.github/workflows/workspace-tests.yaml b/.github/workflows/workspace-tests.yaml
index 07df745a8b..f408caa3f5 100644
--- a/.github/workflows/workspace-tests.yaml
+++ b/.github/workflows/workspace-tests.yaml
@@ -44,7 +44,7 @@ jobs:
     steps:
       - name: Download published-exports artifact for this PR
         if: inputs.workspace != '' && inputs.pr-number != ''
-        uses: dawidd6/action-download-artifact@57aa996fc1713cc1579039614f4645a7f4841fd4 # v23
+        uses: dawidd6/action-download-artifact@d63b86af1b34672e53c440b1b83979861906bad7 # v24
         with:
           name: published-exports-pr-${{ inputs.pr-number }}
           workflow: pr-actions.yaml