diff --git a/.github/workflows/auto-update-semconv.yml b/.github/workflows/auto-update-semconv.yml
index 95a221e..63d9cdd 100644
--- a/.github/workflows/auto-update-semconv.yml
+++ b/.github/workflows/auto-update-semconv.yml
@@ -53,7 +53,7 @@ jobs:
     needs:
       - check-versions
     steps:
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: otelbot-token
         with:
           client-id: ${{ vars.OTELBOT_SEMANTIC_CONVENTIONS_JAVA_CLIENT_ID }}
@@ -129,7 +129,7 @@ jobs:
       - check-versions
       - update-semconv
     if: always()
-    uses: open-telemetry/shared-workflows/.github/workflows/workflow-failure-issue.yml@0cc57aeabf2a31cf41114e7b24561f21a04e360b # v0.18.0
+    uses: open-telemetry/shared-workflows/.github/workflows/workflow-failure-issue.yml@c717adbcb56efc45c5dea293accfc6c3462bcdd1 # v0.19.0
     with:
       success: >-
         ${{
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 541c788..2b28a22 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -49,7 +49,7 @@ jobs:
           cache-read-only: true
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           languages: ${{ matrix.language }}
           # using "linked" helps to keep up with the latest Kotlin support
@@ -66,7 +66,7 @@ jobs:
           DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           category: "/language:${{matrix.language}}"
 
@@ -76,6 +76,6 @@ jobs:
     needs:
       - analyze
     if: always() && github.event_name == 'schedule'
-    uses: open-telemetry/shared-workflows/.github/workflows/workflow-failure-issue.yml@0cc57aeabf2a31cf41114e7b24561f21a04e360b # v0.18.0
+    uses: open-telemetry/shared-workflows/.github/workflows/workflow-failure-issue.yml@c717adbcb56efc45c5dea293accfc6c3462bcdd1 # v0.19.0
     with:
       success: ${{ needs.analyze.result == 'success' }}
diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml
index a0a530d..eb48c29 100644
--- a/.github/workflows/fossa.yml
+++ b/.github/workflows/fossa.yml
@@ -27,6 +27,6 @@ jobs:
     needs:
       - fossa
     if: always()
-    uses: open-telemetry/shared-workflows/.github/workflows/workflow-failure-issue.yml@0cc57aeabf2a31cf41114e7b24561f21a04e360b # v0.18.0
+    uses: open-telemetry/shared-workflows/.github/workflows/workflow-failure-issue.yml@c717adbcb56efc45c5dea293accfc6c3462bcdd1 # v0.19.0
     with:
       success: ${{ needs.fossa.result == 'success' }}
diff --git a/.github/workflows/issue-management-stale-action.yml b/.github/workflows/issue-management-stale-action.yml
index be7d9a6..6b3a435 100644
--- a/.github/workflows/issue-management-stale-action.yml
+++ b/.github/workflows/issue-management-stale-action.yml
@@ -72,6 +72,6 @@ jobs:
     needs:
       - stale
     if: always()
-    uses: open-telemetry/shared-workflows/.github/workflows/workflow-failure-issue.yml@0cc57aeabf2a31cf41114e7b24561f21a04e360b # v0.18.0
+    uses: open-telemetry/shared-workflows/.github/workflows/workflow-failure-issue.yml@c717adbcb56efc45c5dea293accfc6c3462bcdd1 # v0.19.0
     with:
       success: ${{ needs.stale.result == 'success' }}
diff --git a/.github/workflows/ossf-scorecard.yml b/.github/workflows/ossf-scorecard.yml
index 191c5b8..6236dd4 100644
--- a/.github/workflows/ossf-scorecard.yml
+++ b/.github/workflows/ossf-scorecard.yml
@@ -16,7 +16,7 @@ jobs:
       contents: read # for actions/checkout
       id-token: write # for Scorecard to publish results
       security-events: write # for the SARIF upload to code scanning
-    uses: open-telemetry/shared-workflows/.github/workflows/scorecard.yml@0cc57aeabf2a31cf41114e7b24561f21a04e360b # v0.18.0
+    uses: open-telemetry/shared-workflows/.github/workflows/scorecard.yml@c717adbcb56efc45c5dea293accfc6c3462bcdd1 # v0.19.0
 
   workflow-notification:
     permissions:
@@ -24,6 +24,6 @@ jobs:
     needs:
       - analysis
     if: always()
-    uses: open-telemetry/shared-workflows/.github/workflows/workflow-failure-issue.yml@0cc57aeabf2a31cf41114e7b24561f21a04e360b # v0.18.0
+    uses: open-telemetry/shared-workflows/.github/workflows/workflow-failure-issue.yml@c717adbcb56efc45c5dea293accfc6c3462bcdd1 # v0.19.0
     with:
       success: ${{ needs.analysis.result == 'success' }}
diff --git a/.github/workflows/prepare-release-branch.yml b/.github/workflows/prepare-release-branch.yml
index 2dc26d3..4ede6bf 100644
--- a/.github/workflows/prepare-release-branch.yml
+++ b/.github/workflows/prepare-release-branch.yml
@@ -66,7 +66,7 @@ jobs:
       - name: Use CLA approved bot
         run: .github/scripts/use-cla-approved-bot.sh
 
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: otelbot-token
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
@@ -119,7 +119,7 @@ jobs:
       - name: Use CLA approved bot
         run: .github/scripts/use-cla-approved-bot.sh
 
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: otelbot-token
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2489846..8a07a06 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -211,7 +211,7 @@ jobs:
       - name: Use CLA approved bot
         run: .github/scripts/use-cla-approved-bot.sh
 
-      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: otelbot-token
         with:
           client-id: ${{ vars.OTELBOT_CLIENT_ID }}
diff --git a/.github/workflows/reusable-lint-check.yml b/.github/workflows/reusable-lint-check.yml
index fc9e114..1ae9a10 100644
--- a/.github/workflows/reusable-lint-check.yml
+++ b/.github/workflows/reusable-lint-check.yml
@@ -15,7 +15,7 @@ jobs:
           fetch-depth: 0 # needed for merge-base used in modified-files mode
           persist-credentials: false
 
-      - uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1
+      - uses: jdx/mise-action@08ae2a091c038e1e05ec6f5115dc5c69d5a2a6b8 # v5.1.2
 
       - name: Lint for pull requests
         if: github.event_name == 'pull_request'
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index e506e70..ef5deb0 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -17,4 +17,4 @@ jobs:
     permissions:
       contents: read # for actions/checkout
       security-events: write # for zizmor to upload SARIF results
-    uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@0cc57aeabf2a31cf41114e7b24561f21a04e360b # v0.18.0
+    uses: open-telemetry/shared-workflows/.github/workflows/zizmor.yml@c717adbcb56efc45c5dea293accfc6c3462bcdd1 # v0.19.0