diff --git a/.github/workflows/updatecli.yaml b/.github/workflows/updatecli.yaml
index ecdf3b9..75a8f5c 100644
--- a/.github/workflows/updatecli.yaml
+++ b/.github/workflows/updatecli.yaml
@@ -9,9 +9,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout"
-        uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0
+        uses: "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1" # v7.0.1
       - name: "Setup updatecli"
-        uses: "updatecli/updatecli-action@d422ba543720d01a96d4c3e3ab8544cc188cd711" # v3.5.0
+        uses: "updatecli/updatecli-action@5d180ff09f5204e599bbd6030cd1736009ed5ff2" # v3.9.0
       - name: "Run updatecli"
         run: updatecli compose apply --clean-git-branches=true --experimental
         env:
diff --git a/.github/workflows/updatecli_test.yaml b/.github/workflows/updatecli_test.yaml
index 0f606c2..72d12f7 100644
--- a/.github/workflows/updatecli_test.yaml
+++ b/.github/workflows/updatecli_test.yaml
@@ -9,9 +9,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout"
-        uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0
+        uses: "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1" # v7.0.1
       - name: "Setup updatecli"
-        uses: "updatecli/updatecli-action@d422ba543720d01a96d4c3e3ab8544cc188cd711" # v3.5.0
+        uses: "updatecli/updatecli-action@5d180ff09f5204e599bbd6030cd1736009ed5ff2" # v3.9.0
       - name: "Test updatecli in dry-run mode"
         run: "updatecli compose diff"
         env:
diff --git a/.github/workflows/updatecli_update.yaml b/.github/workflows/updatecli_update.yaml
index 38e0e95..3d5a801 100644
--- a/.github/workflows/updatecli_update.yaml
+++ b/.github/workflows/updatecli_update.yaml
@@ -13,9 +13,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout"
-        uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0
+        uses: "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1" # v7.0.1
       - name: "Setup updatecli"
-        uses: "updatecli/updatecli-action@d422ba543720d01a96d4c3e3ab8544cc188cd711" # v3.5.0
+        uses: "updatecli/updatecli-action@5d180ff09f5204e599bbd6030cd1736009ed5ff2" # v3.9.0
       - name: "Run updatecli only on monitored pipelines"
         run: updatecli compose apply --clean-git-branches=true --labels="monitoring:enabled" --experimental
         env:
diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml
index 5c65861..a35b633 100644
--- a/.github/workflows/zizmor.yaml
+++ b/.github/workflows/zizmor.yaml
@@ -12,11 +12,11 @@ jobs:
       security-events: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: "Run zizmor \U0001F308"
-        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
         with:
           # intentionally not scanning the entire repository,
           inputs: ./.github/