diff --git a/.github/workflows/updatecli.yaml b/.github/workflows/updatecli.yaml
index fb175ca..daf7a14 100644
--- a/.github/workflows/updatecli.yaml
+++ b/.github/workflows/updatecli.yaml
@@ -9,9 +9,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout"
-        uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0
+        uses: "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1" # v7.0.1
       - name: "Setup updatecli"
-        uses: "updatecli/updatecli-action@5dfc616e57b07d2302c3f37e5b72a4ead82dbbf8" # v3.4.0
+        uses: "updatecli/updatecli-action@d422ba543720d01a96d4c3e3ab8544cc188cd711" # v3.5.0
       - name: "Run updatecli"
         run: updatecli compose apply --clean-git-branches=true --experimental
         env:
diff --git a/.github/workflows/updatecli_test.yaml b/.github/workflows/updatecli_test.yaml
index 033ec79..8b74471 100644
--- a/.github/workflows/updatecli_test.yaml
+++ b/.github/workflows/updatecli_test.yaml
@@ -9,9 +9,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout"
-        uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0
+        uses: "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1" # v7.0.1
       - name: "Setup updatecli"
-        uses: "updatecli/updatecli-action@5dfc616e57b07d2302c3f37e5b72a4ead82dbbf8" # v3.4.0
+        uses: "updatecli/updatecli-action@d422ba543720d01a96d4c3e3ab8544cc188cd711" # v3.5.0
       - name: "Test updatecli in dry-run mode"
         run: "updatecli compose diff"
         env:
diff --git a/.github/workflows/updatecli_update.yaml b/.github/workflows/updatecli_update.yaml
index 52c71ea..7ed8a5d 100644
--- a/.github/workflows/updatecli_update.yaml
+++ b/.github/workflows/updatecli_update.yaml
@@ -13,9 +13,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout"
-        uses: "actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0" # v7.0.0
+        uses: "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1" # v7.0.1
       - name: "Setup updatecli"
-        uses: "updatecli/updatecli-action@5dfc616e57b07d2302c3f37e5b72a4ead82dbbf8" # v3.4.0
+        uses: "updatecli/updatecli-action@d422ba543720d01a96d4c3e3ab8544cc188cd711" # v3.5.0
       - name: "Run updatecli only on monitored pipelines"
         run: updatecli compose apply --clean-git-branches=true --labels="monitoring:enabled" --experimental
         env:
diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml
index 5c65861..872129a 100644
--- a/.github/workflows/zizmor.yaml
+++ b/.github/workflows/zizmor.yaml
@@ -12,11 +12,11 @@ jobs:
       security-events: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: "Run zizmor \U0001F308"
-        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
         with:
           # intentionally not scanning the entire repository,
           inputs: ./.github/