diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c4ce002..880823e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -283,7 +283,7 @@ jobs:
 
       - name: Build images and push
         id: bake
-        uses: docker/bake-action@018cb6412ab401ebaa809aa5f85966b74628600f # v7.4.0
+        uses: docker/bake-action@59cb1203cd42bcefd40a1b6d73b589e48c86040e # v7.5.0
         with:
           targets: ${{ steps.bake_args.outputs.targets }}
           provenance: true
@@ -318,7 +318,7 @@ jobs:
       - name: Upload digests
         # Single bundled upload: preserves the `<target>/<sha>` directory layout
         # produced by `Export digests`. Adding a target requires no edits here.
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: digest--${{ matrix.variant }}--${{ env.PLATFORM_PAIR }}
           path: /tmp/digest/
@@ -341,7 +341,7 @@ jobs:
         target: ${{ fromJson(needs.prepare.outputs.targets) }}
     steps:
       - name: Download digests
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           path: /tmp/digest
           pattern: digest--${{ matrix.variant }}--*
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 15614eb..9715d3d 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -23,4 +23,4 @@ jobs:
           persist-credentials: false
 
       - name: Zizmor
-        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
\ No newline at end of file
+        uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
\ No newline at end of file