diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 98bf656..eb93294 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -10,7 +10,7 @@ jobs:
       - name: checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: pnpm and node
-        uses: pnpm/setup@fbda4c85fc2e1e08721cd8763afea8f48d60f024 # v3.0.0
+        uses: pnpm/setup@a0881977cd8ea73b1ed212236c99ca10dcc80cf4 # v3.1.1
         with:
           cache: true
       - name: worker types are current
diff --git a/.github/workflows/devskim.yaml b/.github/workflows/devskim.yaml
index 5e6888e..073ccf7 100644
--- a/.github/workflows/devskim.yaml
+++ b/.github/workflows/devskim.yaml
@@ -21,6 +21,6 @@ jobs:
         with:
           ignore-globs: "**/.git/**,**/bin/**,**/pnpm-lock.yaml,**/worker-configuration.d.ts"
       - name: upload
-        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           sarif_file: devskim-results.sarif