diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index fe0d70a..4ed7ccb 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -71,7 +71,7 @@ jobs:
       # the requirements into a throwaway virtualenv, which fails on this
       # graph (one dependency has no sdist for the resolver's Python).
       - name: Scan with osv-scanner
-        uses: google/osv-scanner-action/osv-scanner-action@a345acffa64b0eaede81a3d9aae6141214d9c8fc  # v2.6.0
+        uses: google/osv-scanner-action/osv-scanner-action@b1d267aea5211fa648d9d442fa64b90dbdcbdd36  # v2.7.0
         with:
           scan-args: |-
             --lockfile=uv.lock
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 5b3f4a0..bce3681 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -140,7 +140,7 @@ jobs:
           cache-binary: false
 
       - name: Log in to ghcr.io
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}