diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 71dc664..e16a9d6 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -34,7 +34,7 @@ jobs:
         run: cargo bench --bench bench_main --all-features -- --output-format bencher | tee output.txt
 
       - name: Store benchmark result
-        uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1.22.1
+        uses: benchmark-action/github-action-benchmark@4322e5726e6334590d251fc4f92bec0efafc45dc # v1.22.2
         with:
           name: RulesXP Benchmark
           tool: 'cargo'
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c385bc6..71784f4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -98,7 +98,7 @@ jobs:
         components: llvm-tools-preview
 
     - name: Install cargo-llvm-cov
-      uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375 # v2.87.12
+      uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31
       with:
         tool: cargo-llvm-cov
 
@@ -108,14 +108,14 @@ jobs:
         cargo llvm-cov --all-features --workspace --lcov --output-path lcov.info --no-run
 
     - name: Upload coverage HTML
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
         name: coverage-report
         path: coverage-html/
         retention-days: 30
 
     - name: Upload to Codecov
-      uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+      uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
       with:
         files: lcov.info
         fail_ci_if_error: true
@@ -187,7 +187,7 @@ jobs:
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Install cargo-audit
-      uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375 # v2.87.12
+      uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31
       with:
         tool: cargo-audit
 
@@ -209,7 +209,7 @@ jobs:
         toolchain: nightly
 
     - name: Install cargo-hack and cargo-minimal-versions
-      uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375 # v2.87.12
+      uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31
       with:
         tool: cargo-hack,cargo-minimal-versions
 
@@ -226,7 +226,7 @@ jobs:
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Install typos
-      uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375 # v2.87.12
+      uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31
       with:
         tool: typos-cli
 
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index eb07440..7accf1e 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -75,14 +75,14 @@ jobs:
 
     - name: Upload crash artifacts
       if: steps.check_crashes.outputs.crashes_found == 'true'
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
         name: fuzz-crashes-${{ matrix.target }}
         path: fuzz/artifacts/${{ matrix.target }}/
 
     - name: Upload corpus
       if: always()
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
         name: fuzz-corpus-${{ matrix.target }}
         path: fuzz/corpus/${{ matrix.target }}/
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4f131a8..e0c3313 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -58,7 +58,7 @@ jobs:
         echo "Version check passed: $CARGO_VERSION"
 
     - name: Authenticate with crates.io
-      uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
+      uses: rust-lang/crates-io-auth-action@3268eb413133e2960fa4ae0e963ca76380c54cd9 # v1.0.6
       id: auth
 
     - name: Publish to crates.io