diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 4530443..432ade0 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -33,7 +33,7 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
+        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
         with:
           languages: javascript-typescript
           # security-extended adds the lower-precision queries; worth the noise
@@ -41,6 +41,6 @@ jobs:
           queries: security-extended
 
       - name: Analyze
-        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
+        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee # v4
         with:
           category: '/language:javascript-typescript'
diff --git a/.github/workflows/extension.yml b/.github/workflows/extension.yml
index 06b4dd3..91d0195 100644
--- a/.github/workflows/extension.yml
+++ b/.github/workflows/extension.yml
@@ -53,7 +53,7 @@ jobs:
 
       # Uploaded whether or not this publishes, so a dispatch run leaves
       # something to install and try by hand.
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: vsix
           path: extension/*.vsix