diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 660bee38..2325bd49 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -265,7 +265,7 @@ jobs:
       -
         name: Attach binaries to release
         if: github.event_name == 'release'
-        uses: softprops/action-gh-release@aec2ec56f94eb8180ceec724245f64ef008b89f5 #v2.4.0
+        uses: softprops/action-gh-release@6da8fa9354ddfdc4aeace5fc48d7f679b5214090 #v2.4.1
         with:
           files: |
             ftl_builds/*
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index c53ee588..c366e6c4 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -85,7 +85,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@f443b600d91635bebf5b0d9ebc620189c0d6fba5 #v4.30.8
+      uses: github/codeql-action/init@16140ae1a102900babc80a33c44059580f687047 #v4.30.9
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -108,7 +108,7 @@ jobs:
         ./build.sh
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@f443b600d91635bebf5b0d9ebc620189c0d6fba5 #v4.30.8
+      uses: github/codeql-action/analyze@16140ae1a102900babc80a33c44059580f687047 #v4.30.9
       with:
         category: "/language:${{matrix.language}}"
         upload: failure-only # upload only in case of failure, otherwise upload later after filtering
@@ -134,7 +134,7 @@ jobs:
         output: codeql-results/cpp.sarif
 
     - name: Upload SARIF
-      uses: github/codeql-action/upload-sarif@f443b600d91635bebf5b0d9ebc620189c0d6fba5 #v4.30.8
+      uses: github/codeql-action/upload-sarif@16140ae1a102900babc80a33c44059580f687047 #v4.30.9
       with:
         sarif_file: codeql-results/cpp.sarif
 
diff --git a/.github/workflows/openapi-validator.yml b/.github/workflows/openapi-validator.yml
index 91279c3a..1b4246d9 100644
--- a/.github/workflows/openapi-validator.yml
+++ b/.github/workflows/openapi-validator.yml
@@ -15,7 +15,7 @@ jobs:
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 #v5.0.0
 
       - name: Set up Node.js
-        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 #v5.0.0
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 #v6.0.0
         with:
           node-version: "20"
           cache: npm