diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bb80646..03f4755 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -112,7 +112,7 @@ jobs:
           mkdir dist
           cp "target/${{ matrix.target }}/release/stackstead${{ matrix.suffix }}" \
             "dist/stackstead-${{ matrix.target }}${{ matrix.suffix }}"
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-${{ matrix.target }}-${{ needs.preflight.outputs.revision }}
           path: dist/*
@@ -135,7 +135,7 @@ jobs:
         with:
           ref: ${{ needs.preflight.outputs.revision }}
           persist-credentials: false
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: release-*-${{ needs.preflight.outputs.revision }}
           path: artifacts
@@ -163,7 +163,7 @@ jobs:
           cp LICENSE dist/LICENSE
           rm dist/BINARY_SHA256SUMS
           (cd dist && sha256sum LICENSE install.sh stackstead-* stackstead.rb > SHA256SUMS)
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-bundle-${{ needs.preflight.outputs.revision }}
           path: dist/*
@@ -195,7 +195,7 @@ jobs:
           set -euo pipefail
           test "$(git rev-parse HEAD)" = "$RELEASE_REVISION"
           test "$(git rev-parse "refs/tags/$RELEASE_TAG^{commit}")" = "$RELEASE_REVISION"
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: release-bundle-${{ needs.preflight.outputs.revision }}
           path: dist
diff --git a/.github/workflows/rustsec.yml b/.github/workflows/rustsec.yml
index e6c1483..18b4e32 100644
--- a/.github/workflows/rustsec.yml
+++ b/.github/workflows/rustsec.yml
@@ -40,7 +40,7 @@ jobs:
         with:
           ref: ${{ inputs.revision || github.sha }}
           persist-credentials: false
-      - uses: taiki-e/install-action@9534c84618278caac52cb373bb164ed464dbd8af # v2.87.11
+      - uses: taiki-e/install-action@8cca0918f8471c33515202b73f56ab27f2bed283 # v2.87.29
         with:
           tool: cargo-audit@0.22.2
       - run: cargo audit