diff --git a/.github/workflows/call-github2gerrit.yaml b/.github/workflows/call-github2gerrit.yaml
index 4eb6747cd0c..4c4d9ae06ce 100644
--- a/.github/workflows/call-github2gerrit.yaml
+++ b/.github/workflows/call-github2gerrit.yaml
@@ -33,7 +33,7 @@ jobs:
     steps:
       - name: Convert GitHub PR to Gerrit Change
         # yamllint disable-line rule:line-length
-        uses: lfreleng-actions/github2gerrit-action@6cdadc0d954315c37bbe50cf0edac88eb01df041 # v2.4.2
+        uses: lfreleng-actions/github2gerrit-action@f2ffe06d3ec444fb4ebff0f40362660380490513 # v2.4.3
         with:
           GERRIT_SSH_PRIVKEY_G2G: ${{ secrets.GERRIT_SSH_PRIVKEY_G2G }}
           GERRIT_KNOWN_HOSTS: ${{ vars.GERRIT_KNOWN_HOSTS }}
diff --git a/.github/workflows/clm-scan.yaml b/.github/workflows/clm-scan.yaml
index 411612d64eb..19ce8d3204d 100644
--- a/.github/workflows/clm-scan.yaml
+++ b/.github/workflows/clm-scan.yaml
@@ -82,7 +82,7 @@ jobs:
       - name: Upload policy evaluation report
         if: ${{ always() }}
         # yamllint disable-line rule:line-length
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: sonatype-lifecycle-policy-eval
           path: sonatype-lifecycle-policy-eval.json
diff --git a/.github/workflows/gerrit-sonar.yaml b/.github/workflows/gerrit-sonar.yaml
index 94ee9378562..3996f637ab1 100644
--- a/.github/workflows/gerrit-sonar.yaml
+++ b/.github/workflows/gerrit-sonar.yaml
@@ -60,7 +60,7 @@ jobs:
     permissions:
       contents: read
     # yamllint disable-line rule:line-length
-    uses: lfreleng-actions/security-workflows/.github/workflows/sonarqube-cloud.yaml@4da5165382f8ca9b5ef0270caa343be4a63493d5 # v0.9.2
+    uses: lfreleng-actions/security-workflows/.github/workflows/sonarqube-cloud.yaml@6c2ced2c9310a4f2606ad29a464e9f2d8fd397b8 # v0.9.3
     with:
       # Gerrit dispatches carry a refspec and check out the change;
       # the weekly schedule leaves it empty and takes the branch.
diff --git a/.github/workflows/gerrit-verify.yaml b/.github/workflows/gerrit-verify.yaml
index a81b03a07bf..1eefaa8efb5 100644
--- a/.github/workflows/gerrit-verify.yaml
+++ b/.github/workflows/gerrit-verify.yaml
@@ -74,7 +74,7 @@ jobs:
   maven-verify:
     needs: prepare
     # yamllint disable-line rule:line-length
-    uses: lfit/releng-reusable-workflows/.github/workflows/compose-maven-verify.yaml@87eacd1f8322263ebbc1411ce2ea82bab10ed091 # v0.10.3
+    uses: lfit/releng-reusable-workflows/.github/workflows/compose-maven-verify.yaml@fb907909b12bbaf262de6b24fcafd181cabe6b24 # v0.10.4
     with:
       GERRIT_BRANCH: ${{ inputs.GERRIT_BRANCH }}
       GERRIT_CHANGE_ID: ${{ inputs.GERRIT_CHANGE_ID }}
@@ -100,7 +100,7 @@ jobs:
   pre-commit-linting:
     needs: prepare
     # yamllint disable-line rule:line-length
-    uses: lfit/releng-reusable-workflows/.github/workflows/compose-repo-linting.yaml@87eacd1f8322263ebbc1411ce2ea82bab10ed091 # v0.10.3
+    uses: lfit/releng-reusable-workflows/.github/workflows/compose-repo-linting.yaml@fb907909b12bbaf262de6b24fcafd181cabe6b24 # v0.10.4
     with:
       GERRIT_BRANCH: ${{ inputs.GERRIT_BRANCH }}
       GERRIT_CHANGE_ID: ${{ inputs.GERRIT_CHANGE_ID }}
@@ -115,7 +115,7 @@ jobs:
   tox-verify:
     needs: prepare
     # yamllint disable-line rule:line-length
-    uses: lfit/releng-reusable-workflows/.github/workflows/gerrit-compose-required-tox-verify.yaml@87eacd1f8322263ebbc1411ce2ea82bab10ed091 # v0.10.3
+    uses: lfit/releng-reusable-workflows/.github/workflows/gerrit-compose-required-tox-verify.yaml@fb907909b12bbaf262de6b24fcafd181cabe6b24 # v0.10.4
     with:
       GERRIT_BRANCH: ${{ inputs.GERRIT_BRANCH }}
       GERRIT_CHANGE_ID: ${{ inputs.GERRIT_CHANGE_ID }}