diff --git a/.github/workflows/go.yaml b/.github/workflows/go.yaml
index f563feff..210e3bcb 100644
--- a/.github/workflows/go.yaml
+++ b/.github/workflows/go.yaml
@@ -47,7 +47,7 @@ jobs:
           # we always use the latest patch version.
           version: v2.15.0
       - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
         with:
           install-only: true
       - name: Show GoReleaser version
diff --git a/.github/workflows/release-sandbox.yaml b/.github/workflows/release-sandbox.yaml
index 153286fe..896c392a 100644
--- a/.github/workflows/release-sandbox.yaml
+++ b/.github/workflows/release-sandbox.yaml
@@ -39,7 +39,7 @@ jobs:
           cache: false
         id: go
       - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
         with:
           install-only: true
       - name: Show GoReleaser version
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index edae8cd4..2bb9c887 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -41,18 +41,18 @@ jobs:
           cache: false
         id: go
       - name: Install GoReleaser
-        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
         with:
           install-only: true
       - name: Show GoReleaser version
         run: goreleaser --version
       - name: Login to DockerHub
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}
       - name: Login to GitHub Docker Registry
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml
index a35b633b..87fa32a7 100644
--- a/.github/workflows/zizmor.yaml
+++ b/.github/workflows/zizmor.yaml
@@ -16,7 +16,7 @@ jobs:
         with:
           persist-credentials: false
       - name: "Run zizmor \U0001F308"
-        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
         with:
           # intentionally not scanning the entire repository,
           inputs: ./.github/