diff --git a/.github/workflows/baas-release.yml b/.github/workflows/baas-release.yml
index 9de21174..1fd70397 100644
--- a/.github/workflows/baas-release.yml
+++ b/.github/workflows/baas-release.yml
@@ -99,14 +99,14 @@ jobs:
         run: |
           git config --global url."https://x-access-token:${GH_TOKEN}@github.com/".insteadOf "git@github.com:"
           git submodule update --init apps/grobase
-      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
       # Docker Hub — where the images go (public by default on push).
-      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4
+      - uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_TOKEN }}
       # GHCR — layer-cache push only (cache-to refs in docker-bake.hcl).
-      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4
+      - uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -146,8 +146,8 @@ jobs:
         run: |
           git config --global url."https://x-access-token:${GH_TOKEN}@github.com/".insteadOf "git@github.com:"
           git submodule update --init apps/grobase
-      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
-      - uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+      - uses: docker/login-action@8aa5831fb8d48d8f76594c7ddde61ae58019f550 # v4
         with:
           username: ${{ secrets.DOCKER_HUB_USERNAME }}
           password: ${{ secrets.DOCKER_HUB_TOKEN }}
@@ -219,7 +219,7 @@ jobs:
           sed -E 's#^VERSION="\$\{BINOCLE_VERSION:-[^}]*\}"#VERSION="${BINOCLE_VERSION:-'"$VER"'}"#' \
             apps/grobase/scripts/ci/install.sh > release-assets/install.sh
           grep '^VERSION=' release-assets/install.sh
-      - uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3
+      - uses: softprops/action-gh-release@8a0cd651e5b2365bd640854a3fa5dfc70e4875f3 # v3
         with:
           name: "Grobase BaaS ${{ github.ref_name }}"
           prerelease: ${{ needs.version.outputs.prerelease == 'true' }}
diff --git a/.github/workflows/mini-baas-security.yml b/.github/workflows/mini-baas-security.yml
index 7318a5f5..3cf656c6 100644
--- a/.github/workflows/mini-baas-security.yml
+++ b/.github/workflows/mini-baas-security.yml
@@ -163,7 +163,7 @@ jobs:
 
       - name: Trivy filesystem scan
 
-        uses: aquasecurity/trivy-action@8f28faec26515256b6d22074d1d2a8986f4cbd87 # master at 2026-11-04
+        uses: aquasecurity/trivy-action@38b337fff0a2f984d5be173c99e3f633438167ec # master at 2026-11-04
 
         with:
           scan-type: fs
@@ -210,7 +210,7 @@ jobs:
       - name: Trivy image scan
         if: steps.build_img.outcome == 'success'
 
-        uses: aquasecurity/trivy-action@8f28faec26515256b6d22074d1d2a8986f4cbd87 # master at 2026-11-04
+        uses: aquasecurity/trivy-action@38b337fff0a2f984d5be173c99e3f633438167ec # master at 2026-11-04
 
         with:
           image-ref: mini-baas/query-router:ci
@@ -248,7 +248,7 @@ jobs:
 
       - name: TruffleHog OSS
 
-        uses: trufflesecurity/trufflehog@93633ac70c28603931c365b6ef530cab878f4286 # main at 2026-11-04
+        uses: trufflesecurity/trufflehog@188766766fd81cde66e5500b0db0379235637134 # main at 2026-11-04
 
         with:
           path: ./