diff --git a/.github/workflows/boilerplate.yaml b/.github/workflows/boilerplate.yaml
index d3b8e894b..34b4fea32 100644
--- a/.github/workflows/boilerplate.yaml
+++ b/.github/workflows/boilerplate.yaml
@@ -33,7 +33,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: chainguard-dev/actions/boilerplate@f0be69916b439d0fcced2451b23d0f27cd46d545 # main
+      - uses: chainguard-dev/actions/boilerplate@4d37df0d85a91f619edc34a8803323033cdcb124 # main
         with:
           extension: ${{ matrix.extension }}
           language: ${{ matrix.language }}
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 1cc39eb35..6c33b32a3 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -19,7 +19,7 @@ jobs:
           go-version-file: "go.mod"
           check-latest: true
 
-      - uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # v1.0.4
+      - uses: golang/govulncheck-action@032d45514ae346b1db93c04b0c90b841c370344f # v1.1.0
         with:
           go-version-file: "go.mod"
           repo-checkout: false
diff --git a/.github/workflows/donotsubmit.yaml b/.github/workflows/donotsubmit.yaml
index 01eaaa0bf..f8b786f3e 100644
--- a/.github/workflows/donotsubmit.yaml
+++ b/.github/workflows/donotsubmit.yaml
@@ -19,4 +19,4 @@ jobs:
       with:
         persist-credentials: false
 
-    - uses: chainguard-dev/actions/donotsubmit@f0be69916b439d0fcced2451b23d0f27cd46d545 # main
+    - uses: chainguard-dev/actions/donotsubmit@4d37df0d85a91f619edc34a8803323033cdcb124 # main
diff --git a/.github/workflows/kind-e2e.yaml b/.github/workflows/kind-e2e.yaml
index fc8ac5c89..ecdedc6ce 100644
--- a/.github/workflows/kind-e2e.yaml
+++ b/.github/workflows/kind-e2e.yaml
@@ -37,7 +37,7 @@ jobs:
       run: go install ./
 
     - name: Setup Cluster
-      uses: chainguard-dev/actions/setup-kind@f0be69916b439d0fcced2451b23d0f27cd46d545 # main
+      uses: chainguard-dev/actions/setup-kind@4d37df0d85a91f619edc34a8803323033cdcb124 # main
       with:
         registry-authority: ${{ env.REGISTRY_NAME }}:${{ env.REGISTRY_PORT }}
 
@@ -71,4 +71,4 @@ jobs:
 
     - name: Collect diagnostics and upload
       if: ${{ failure() }}
-      uses: chainguard-dev/actions/kind-diag@f0be69916b439d0fcced2451b23d0f27cd46d545 # main
+      uses: chainguard-dev/actions/kind-diag@4d37df0d85a91f619edc34a8803323033cdcb124 # main
diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml
index 1ea660c65..e4cf774cc 100644
--- a/.github/workflows/stale.yaml
+++ b/.github/workflows/stale.yaml
@@ -15,7 +15,7 @@ jobs:
       pull-requests: write
 
     steps:
-    - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
+    - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/style.yaml b/.github/workflows/style.yaml
index 25aeee7d4..d7ed823c9 100644
--- a/.github/workflows/style.yaml
+++ b/.github/workflows/style.yaml
@@ -25,7 +25,7 @@ jobs:
           go-version-file: 'go.mod'
           check-latest: true
 
-      - uses: chainguard-dev/actions/gofmt@f0be69916b439d0fcced2451b23d0f27cd46d545
+      - uses: chainguard-dev/actions/gofmt@4d37df0d85a91f619edc34a8803323033cdcb124
         with:
           args: -s
 
@@ -46,7 +46,7 @@ jobs:
           go-version-file: 'go.mod'
           check-latest: true
 
-      - uses: chainguard-dev/actions/goimports@f0be69916b439d0fcced2451b23d0f27cd46d545
+      - uses: chainguard-dev/actions/goimports@4d37df0d85a91f619edc34a8803323033cdcb124
 
   lint:
     name: Lint
@@ -67,10 +67,10 @@ jobs:
           go-version-file: 'go.mod'
           check-latest: true
 
-      - uses: chainguard-dev/actions/trailing-space@f0be69916b439d0fcced2451b23d0f27cd46d545
+      - uses: chainguard-dev/actions/trailing-space@4d37df0d85a91f619edc34a8803323033cdcb124
         if: ${{ always() }}
 
-      - uses: chainguard-dev/actions/eof-newline@f0be69916b439d0fcced2451b23d0f27cd46d545
+      - uses: chainguard-dev/actions/eof-newline@4d37df0d85a91f619edc34a8803323033cdcb124
         if: ${{ always() }}
 
       - uses: reviewdog/action-misspell@d6429416b12b09b4e2768307d53bef58d172e962 # v1.27.0