diff --git a/.github/workflows/reusable_basic.yml b/.github/workflows/reusable_basic.yml
index 3c4d63c005..4c95060bfc 100644
--- a/.github/workflows/reusable_basic.yml
+++ b/.github/workflows/reusable_basic.yml
@@ -281,7 +281,7 @@ jobs:
     # Ensure that the required environment is set
     # Note: While this step is required for the clang-cl compiler, it can be executed for all jobs
     - name: Setup MSVC dev command prompt
-      uses: TheMrMilchmann/setup-msvc-dev@fb19abb8a41b3cf0340f5d1be17d420309232be6 # v3.0.1
+      uses: TheMrMilchmann/setup-msvc-dev@79dac248aac9d0059f86eae9d8b5bfab4e95e97c # v4.0.0
       with:
         arch: x64
 
diff --git a/.github/workflows/reusable_checks.yml b/.github/workflows/reusable_checks.yml
index 926856b09d..e2d98edb56 100644
--- a/.github/workflows/reusable_checks.yml
+++ b/.github/workflows/reusable_checks.yml
@@ -57,7 +57,7 @@ jobs:
         ./scripts/check_license/check_headers.sh . "Apache-2.0 WITH LLVM-exception" -v
 
     - name: Run a spell check
-      uses: crate-ci/typos@87d57f0e994b0e73e3efb34a953ae275b86b5971 # v1.35.6
+      uses: crate-ci/typos@b6297a6a5072df106aa9d94197f5d0533a9730bc # v1.36.1
       with:
         config: ./.github/workflows/.spellcheck-conf.toml
 
diff --git a/.github/workflows/reusable_codeql.yml b/.github/workflows/reusable_codeql.yml
index 77e6b4d63d..f1dda07b7e 100644
--- a/.github/workflows/reusable_codeql.yml
+++ b/.github/workflows/reusable_codeql.yml
@@ -41,7 +41,7 @@ jobs:
         python-version: "3.10"
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@3c3833e0f8c1c83d449a7478aa59c036a9165498 # v3.29.5
+      uses: github/codeql-action/init@2d92b76c45b91eb80fc44c74ce3fce0ee94e8f9d # v3.29.5
       with:
         languages: cpp
         trap-caching: false
@@ -108,7 +108,7 @@ jobs:
       run: cmake --build ${{env.BUILD_DIR}} --config Release -j
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@3c3833e0f8c1c83d449a7478aa59c036a9165498 # v3.29.5
+      uses: github/codeql-action/analyze@2d92b76c45b91eb80fc44c74ce3fce0ee94e8f9d # v3.29.5
 
     - name: "[Win] Prepare vcpkg cache"
       if: matrix.os == 'windows-latest' && steps.cache.outputs.cache-hit != 'true'
diff --git a/.github/workflows/reusable_trivy.yml b/.github/workflows/reusable_trivy.yml
index d44b97af52..e3a03749c6 100644
--- a/.github/workflows/reusable_trivy.yml
+++ b/.github/workflows/reusable_trivy.yml
@@ -21,7 +21,7 @@ jobs:
           fetch-depth: 0
 
       - name: Run Trivy
-        uses: aquasecurity/trivy-action@f9424c10c36e288d5fa79bd3dfd1aeb2d6eae808 # v0.33.0
+        uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # v0.33.1
         with:
           scan-type: 'config'
           hide-progress: false
@@ -38,6 +38,6 @@ jobs:
           cat trivy-results.sarif
 
       - name: Upload results
-        uses: github/codeql-action/upload-sarif@3c3833e0f8c1c83d449a7478aa59c036a9165498 # v3.29.5
+        uses: github/codeql-action/upload-sarif@2d92b76c45b91eb80fc44c74ce3fce0ee94e8f9d # v3.29.5
         with:
           sarif_file: 'trivy-results.sarif'
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index d2923ee2fe..9094b0d888 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -49,6 +49,6 @@ jobs:
 
     # Upload the results to GitHub's code scanning dashboard.
     - name: Upload to code-scanning
-      uses: github/codeql-action/upload-sarif@3c3833e0f8c1c83d449a7478aa59c036a9165498 # v3.29.5
+      uses: github/codeql-action/upload-sarif@2d92b76c45b91eb80fc44c74ce3fce0ee94e8f9d # v3.29.5
       with:
         sarif_file: scorecard_results.sarif