diff --git a/.github/workflows/auto-labeler.yaml b/.github/workflows/auto-labeler.yaml
index aedab4e..7f7deb7 100644
--- a/.github/workflows/auto-labeler.yaml
+++ b/.github/workflows/auto-labeler.yaml
@@ -18,7 +18,7 @@ jobs:
       contents: read # Read the release-drafter config
       pull-requests: write # Apply labels to the pull request
       issues: write # Create labels referenced in the config but missing from the repo
-    uses: github-community-projects/ospo-reusable-workflows/.github/workflows/auto-labeler.yaml@690dbbefe65f0c1d68c5211dd6ff997f533099b5 # v2.2.0
+    uses: github-community-projects/ospo-reusable-workflows/.github/workflows/auto-labeler.yaml@3e055d5fc59e62419fb3103d96fd116ddcf89c8c # v2.3.0
     with:
       config-name: release-drafter.yml
     secrets:
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index f6a00af..1a1064d 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -32,7 +32,7 @@ jobs:
       # Plain output that fails the job; no code scanning upload, so no
       # security-events permission. Reads .github/zizmor.yml.
       - name: zizmor
-        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
         with:
           version: 1.30.1
           advanced-security: false
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 85155f5..4be5563 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -20,7 +20,7 @@ jobs:
     permissions:
       contents: write # Create releases and push tags
       pull-requests: read # Read PR labels for release-drafter
-    uses: github-community-projects/ospo-reusable-workflows/.github/workflows/release-minimal.yaml@690dbbefe65f0c1d68c5211dd6ff997f533099b5 # v2.2.0
+    uses: github-community-projects/ospo-reusable-workflows/.github/workflows/release-minimal.yaml@3e055d5fc59e62419fb3103d96fd116ddcf89c8c # v2.3.0
     with:
       release-config-name: release-drafter.yml
       publish: true