diff --git a/.github/workflows/e2e.yaml b/.github/workflows/e2e.yaml
index 47f02211..a860a7e3 100644
--- a/.github/workflows/e2e.yaml
+++ b/.github/workflows/e2e.yaml
@@ -46,7 +46,7 @@ jobs:
         uses: helm/kind-action@a1b0e391336a6ee6713a0583f8c6240d70863de3
         with:
           install_only: true
-      - uses: yokawasa/action-setup-kube-tools@8249217d23f5ccc53a92b1a2b1f6797f6bc0947a
+      - uses: yokawasa/action-setup-kube-tools@ebd6f098e4d66281876e21f576a024a3b97ed968
         with:
           kustomize: '5.0.1'
           tilt: '0.32.2'
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 5712a12c..42e75ff7 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -99,9 +99,9 @@ jobs:
         mkdir -p output
         helm template ./deploy --namespace ocm-system --set "manager.image.tag=${{ env.RELEASE_VERSION }}" --include-crds > ./output/install.yaml
     - name: Setup Syft
-      uses: anchore/sbom-action/download-syft@da167eac915b4e86f08b264dbdbc867b61be6f0c # v0.20.5
+      uses: anchore/sbom-action/download-syft@f8bdd1d8ac5e901a77a92f111440fdb1b593736b # v0.20.6
     - name: Setup Cosign
-      uses: sigstore/cosign-installer@d58896d6a1865668819e1d91763c7751a165e159
+      uses: sigstore/cosign-installer@d7543c93d881b35a8faa02e8e3605f69b7a1ce62
     - name: Run goreleaser
       uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a
       with: