diff --git a/.github/workflows/build-kdoc.yml b/.github/workflows/build-kdoc.yml
index f15ff38..b5e15f7 100644
--- a/.github/workflows/build-kdoc.yml
+++ b/.github/workflows/build-kdoc.yml
@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           submodules: recursive   # translations live in the l10n submodule
-      - uses: actions/setup-java@v6.0.0
+      - uses: actions/setup-java@v6.0.1
         with:
           distribution: temurin
           java-version: 21   # keep in sync with gradle/gradle-daemon-jvm.properties
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index f9576d3..9c046de 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -14,6 +14,6 @@ jobs:
         submodules: recursive   # translations live in the l10n submodule
 
     - name: Analyze code with CodeQL
-      uses: github/codeql-action/analyze@v4.37.9
+      uses: github/codeql-action/analyze@v4.38.2
       with:
         category: "security"
\ No newline at end of file
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 47ce4f8..1476bac 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -15,7 +15,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           submodules: recursive   # translations live in the l10n submodule
-      - uses: actions/setup-java@v6.0.0
+      - uses: actions/setup-java@v6.0.1
         with:
           distribution: temurin
           java-version: 21   # keep in sync with gradle/gradle-daemon-jvm.properties
@@ -32,7 +32,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           submodules: recursive   # translations live in the l10n submodule
-      - uses: actions/setup-java@v6.0.0
+      - uses: actions/setup-java@v6.0.1
         with:
           distribution: temurin
           java-version: 21   # keep in sync with gradle/gradle-daemon-jvm.properties