diff --git a/.github/workflows/clm-scan.yaml b/.github/workflows/clm-scan.yaml
index 5f17e27ff00..0e4b9e486b3 100644
--- a/.github/workflows/clm-scan.yaml
+++ b/.github/workflows/clm-scan.yaml
@@ -33,7 +33,7 @@ jobs:
 
       - name: Setup Java
         # yamllint disable-line rule:line-length
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: "temurin"
           java-version: "21"
diff --git a/.github/workflows/gerrit-maven-merge.yaml b/.github/workflows/gerrit-maven-merge.yaml
index 5e22b7affef..9c5d716154a 100644
--- a/.github/workflows/gerrit-maven-merge.yaml
+++ b/.github/workflows/gerrit-maven-merge.yaml
@@ -81,7 +81,7 @@ jobs:
         # needs: chain below is unaffected.
         if: github.event_name != 'schedule'
         # yamllint disable-line rule:line-length
-        uses: lfit/gerrit-review-action@a1c036a59b94c8ab89de26d378f6a28cc7378b13 # v1.1.2
+        uses: lfit/gerrit-review-action@1e3eae766b3de755a2e87aa216cedebbaf9c8292 # v1.1.3
         with:
           host: ${{ vars.GERRIT_SERVER }}
           username: ${{ vars.GERRIT_SSH_USER }}
@@ -136,7 +136,7 @@ jobs:
         uses: im-open/workflow-conclusion@8eac7f17381a6917bc04fec3e2c92e70ebc37526 # v3.0.0
       - name: Set vote
         # yamllint disable-line rule:line-length
-        uses: lfit/gerrit-review-action@a1c036a59b94c8ab89de26d378f6a28cc7378b13 # v1.1.2
+        uses: lfit/gerrit-review-action@1e3eae766b3de755a2e87aa216cedebbaf9c8292 # v1.1.3
         with:
           host: ${{ vars.GERRIT_SERVER }}
           username: ${{ vars.GERRIT_SSH_USER }}
diff --git a/.github/workflows/gerrit-sonar.yaml b/.github/workflows/gerrit-sonar.yaml
index e1622713308..110e5697ece 100644
--- a/.github/workflows/gerrit-sonar.yaml
+++ b/.github/workflows/gerrit-sonar.yaml
@@ -60,7 +60,7 @@ jobs:
     permissions:
       contents: read
     # yamllint disable-line rule:line-length
-    uses: lfreleng-actions/security-workflows/.github/workflows/sonarqube-cloud.yaml@0dd3d5f05930b3c782a67f7735fd0133c0fa51d9 # v0.6.1
+    uses: lfreleng-actions/security-workflows/.github/workflows/sonarqube-cloud.yaml@bdcf7d8d599788e3eb70e2d761c9f6abd49c06e5 # v0.7.0
     with:
       # Gerrit dispatches carry a refspec and check out the change;
       # the weekly schedule leaves it empty and takes the branch.