diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index a0e7b336..7522de43 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -29,9 +29,9 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           languages: javascript-typescript
 
       - name: Analyze repository
-        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 6373dfd6..cb61a891 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -208,7 +208,7 @@ jobs:
         working-directory: cli
 
       - name: Upload tested release binary
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-${{ matrix.artifact }}
           path: dist/${{ matrix.artifact }}
@@ -269,7 +269,7 @@ jobs:
           bun-version-file: .bun-version
 
       - name: Install Node.js for npm provenance
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version-file: .node-version
           registry-url: "https://registry.npmjs.org"
@@ -283,7 +283,7 @@ jobs:
         working-directory: cli
 
       - name: Download tested release binaries
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: release-altertable-*
           path: dist
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 69d99e5b..062b7d45 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -80,7 +80,7 @@ jobs:
         working-directory: cli
 
       - name: Upload compiled binary
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ matrix.artifact }}
           path: dist/${{ matrix.artifact }}
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index 2f192cab..2d893956 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -56,7 +56,7 @@ jobs:
         run: ./scripts/verify.sh --integration
 
       - name: Upload coverage report
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: cli-coverage-lcov-${{ github.run_id }}-${{ github.run_attempt }}
           path: cli/coverage/lcov.info