diff --git a/.github/workflows/flow-dependency-review.yml b/.github/workflows/flow-dependency-review.yml
index 2b4bf36..eeb9c3a 100644
--- a/.github/workflows/flow-dependency-review.yml
+++ b/.github/workflows/flow-dependency-review.yml
@@ -29,7 +29,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/flow-ossf-scorecard.yml b/.github/workflows/flow-ossf-scorecard.yml
index 0df3e53..3c3b133 100644
--- a/.github/workflows/flow-ossf-scorecard.yml
+++ b/.github/workflows/flow-ossf-scorecard.yml
@@ -32,7 +32,7 @@ jobs:
       checks: read
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/flow-pull-request-formatting.yaml b/.github/workflows/flow-pull-request-formatting.yaml
index 6cb44c2..1548927 100644
--- a/.github/workflows/flow-pull-request-formatting.yaml
+++ b/.github/workflows/flow-pull-request-formatting.yaml
@@ -40,7 +40,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/flow-release-scaleset-images.yaml b/.github/workflows/flow-release-scaleset-images.yaml
index 48b4baf..9e81194 100644
--- a/.github/workflows/flow-release-scaleset-images.yaml
+++ b/.github/workflows/flow-release-scaleset-images.yaml
@@ -88,7 +88,7 @@ jobs:
       - versions
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
@@ -144,7 +144,7 @@ jobs:
     if: ${{ github.event.inputs.dry-run-enabled != 'true' && github.ref_name == 'main' }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
@@ -185,7 +185,7 @@ jobs:
       - update-version
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/zxc-build-scaleset-images.yaml b/.github/workflows/zxc-build-scaleset-images.yaml
index a42c105..ee49a0b 100644
--- a/.github/workflows/zxc-build-scaleset-images.yaml
+++ b/.github/workflows/zxc-build-scaleset-images.yaml
@@ -110,7 +110,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
@@ -188,7 +188,7 @@ jobs:
       - create-tool-cache
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/zxc-retrieve-upstream-versions.yaml b/.github/workflows/zxc-retrieve-upstream-versions.yaml
index bff5084..8a7e1ca 100644
--- a/.github/workflows/zxc-retrieve-upstream-versions.yaml
+++ b/.github/workflows/zxc-retrieve-upstream-versions.yaml
@@ -65,7 +65,7 @@ jobs:
       hooks-version: ${{ steps.hooks.outputs.version }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/zxcron-automatic-releases.yaml b/.github/workflows/zxcron-automatic-releases.yaml
index a6f3de0..e8c4129 100644
--- a/.github/workflows/zxcron-automatic-releases.yaml
+++ b/.github/workflows/zxcron-automatic-releases.yaml
@@ -42,7 +42,7 @@ jobs:
       scaleset-release-needed: ${{ steps.scaleset-release.outputs.needed }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
@@ -77,7 +77,7 @@ jobs:
     if: ${{ needs.safety-checks.outputs.scaleset-release-needed == 'true' }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/zxf-forked-pull-request-closer.yaml b/.github/workflows/zxf-forked-pull-request-closer.yaml
index ce0029c..a37a22f 100644
--- a/.github/workflows/zxf-forked-pull-request-closer.yaml
+++ b/.github/workflows/zxf-forked-pull-request-closer.yaml
@@ -38,7 +38,7 @@ jobs:
     if: ${{ github.event.pull_request.head.repo.fork && github.actor != 'dependabot[bot]' }}
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@a90bcbc6539c36a85cdfeb73f7e2f433735f215b # v2.15.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit