diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index be05ed8da..0b7cabd84 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -95,7 +95,7 @@ jobs:
           path: .
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -138,7 +138,7 @@ jobs:
           path: .
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -265,7 +265,7 @@ jobs:
           path: .
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -315,7 +315,7 @@ jobs:
           path: .
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -365,7 +365,7 @@ jobs:
           path: .
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
           python-version: ${{ matrix.python-version }}
 
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 4cccb2d32..cf59b8b16 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -11,6 +11,6 @@ permissions:
 
 jobs:
   lint:
-    uses: plus3it/actions-workflows/.github/workflows/lint.yml@ddd67e99878a285f728de398c1116151c2d7791a
+    uses: plus3it/actions-workflows/.github/workflows/lint.yml@0a03f75193a010b3532cc90e8ad0b15a09ed33c1
     with:
       tardigradelint-target: -o python/lint lint
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 316dce324..cee44e540 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -85,20 +85,20 @@ jobs:
           upload-release-assets: false
 
       - name: Attest SBOM for release distributions
-        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763
+        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6
         with:
           subject-path: dist/*
           sbom-path: sbom/watchmaker-dists.spdx.json
 
       - name: Attest SBOM for standalone distributions
-        uses: actions/attest@a1948c3f048ba23858d222213b7c278aabede763
+        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6
         with:
           subject-path: .pyinstaller/dist/*/*
           sbom-path: sbom/watchmaker-standalone.spdx.json
 
       - name: Create GitHub release
         id: release
-        uses: plus3it/actions-workflows/.github/actions/release@ddd67e99878a285f728de398c1116151c2d7791a
+        uses: plus3it/actions-workflows/.github/actions/release@0a03f75193a010b3532cc90e8ad0b15a09ed33c1
         with:
           release-token: "${{ secrets.GH_RELEASES_TOKEN }}"
           release-files: |
@@ -126,7 +126,7 @@ jobs:
           run-id: ${{ github.event.workflow_run.id }}
 
       - name: Publish package distributions to PyPI
-        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b
+        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247
 
   # Publish package to S3
   publish-s3: