diff --git a/.github/workflows/check_diff_action.yaml b/.github/workflows/check_diff_action.yaml
index 90ca63050..85412aa9d 100644
--- a/.github/workflows/check_diff_action.yaml
+++ b/.github/workflows/check_diff_action.yaml
@@ -34,7 +34,7 @@ jobs:
     - name: Restore / Reuse Cache from central build
       id: cache-golang-restore
       # Only Restore, not build another cache (too big)
-      uses: actions/cache/restore@a7833574556fa59680c1b7cb190c1735db73ebf0 # v5.0.0
+      uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
       with:
         path: |
           ${{ env.go_cache }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 5ee6111d3..4ba130072 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -87,7 +87,7 @@ jobs:
       if: matrix.build-mode == 'manual'
       id: cache-golang-restore
       # Only Restore, not build another cache (too big) 
-      uses: actions/cache/restore@a7833574556fa59680c1b7cb190c1735db73ebf0 # v5.0.0
+      uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
       with:
         path: |
           ${{ env.go_cache }}
@@ -100,7 +100,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@cf1bb45a277cb3c205638b2cd5c984db1c46a412 # v3.29.5
+      uses: github/codeql-action/init@1b168cd39490f61582a9beae412bb7057a6b2c4e # v3.29.5
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -117,7 +117,7 @@ jobs:
       run: make build -j
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@cf1bb45a277cb3c205638b2cd5c984db1c46a412 # v3.29.5
+      uses: github/codeql-action/analyze@1b168cd39490f61582a9beae412bb7057a6b2c4e # v3.29.5
       with:
         category: "/language:${{matrix.language}}"
 
diff --git a/.github/workflows/components.yaml b/.github/workflows/components.yaml
index 68a6dc99e..0ba01a3e8 100644
--- a/.github/workflows/components.yaml
+++ b/.github/workflows/components.yaml
@@ -88,7 +88,7 @@ jobs:
       - name: Restore / Reuse Cache from central build
         id: cache-golang-restore
         # Only Restore, not build another cache (too big)
-        uses: actions/cache/restore@a7833574556fa59680c1b7cb190c1735db73ebf0 # v5.0.0
+        uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
         with:
           path: |
             ${{ env.go_cache }}
@@ -112,7 +112,7 @@ jobs:
           make \
             ctf descriptor describe
       - name: Upload CTF
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           if-no-files-found: error
           overwrite: true
@@ -134,7 +134,7 @@ jobs:
         with:
           ref: ${{ env.REF }}
       - name: Download CTFs
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           pattern: 'ctf-component-*'
           path: gen/downloaded-ctfs
@@ -176,7 +176,7 @@ jobs:
       - name: Upload aggregated CTF
         # only upload the artifact if we are not on a PR
         if: inputs.upload-ctf
-        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           if-no-files-found: error
           overwrite: true
diff --git a/.github/workflows/lint_and_test.yaml b/.github/workflows/lint_and_test.yaml
index 2b231e8be..c94a322ab 100644
--- a/.github/workflows/lint_and_test.yaml
+++ b/.github/workflows/lint_and_test.yaml
@@ -39,7 +39,7 @@ jobs:
       - name: Restore / Reuse Cache from central build
         id: cache-golang-restore
         # Only Restore, not build another cache (too big)
-        uses: actions/cache/restore@a7833574556fa59680c1b7cb190c1735db73ebf0 # v5.0.0
+        uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
         with:
           path: |
             ${{ env.go_cache }}
@@ -59,7 +59,7 @@ jobs:
         id: cache-golang-save
         if: github.ref == 'refs/heads/main' # Only run on main, never in PR
         # Only saves cache build-test (linux-amd64)
-        uses: actions/cache/save@a7833574556fa59680c1b7cb190c1735db73ebf0 # v5.0.0
+        uses: actions/cache/save@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
         with:
           path: |
             ${{ env.go_cache }}
@@ -93,7 +93,7 @@ jobs:
       - name: Restore / Reuse Cache from central build
         id: cache-golang-restore
         # Only Restore, not build another cache (too big)
-        uses: actions/cache/restore@a7833574556fa59680c1b7cb190c1735db73ebf0 # v5.0.0
+        uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
         with:
           path: |
             ${{ env.go_cache }}
diff --git a/.github/workflows/publish-latest.yaml b/.github/workflows/publish-latest.yaml
index 167d5668e..0d4d19432 100644
--- a/.github/workflows/publish-latest.yaml
+++ b/.github/workflows/publish-latest.yaml
@@ -48,7 +48,7 @@ jobs:
           images: |            
             ghcr.io/${{ github.repository }}
       - name: Go Build Cache for Docker
-        uses: actions/cache@a7833574556fa59680c1b7cb190c1735db73ebf0 # v5.0.0
+        uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
         with:
           path: go-build-cache
           key: ${{ runner.os }}-go-build-cache-${{ hashFiles('**/go.sum') }}
@@ -116,7 +116,7 @@ jobs:
     - name: Restore / Reuse Cache from central build
       id: cache-golang-restore
       # Only Restore, not build another cache (too big)
-      uses: actions/cache/restore@a7833574556fa59680c1b7cb190c1735db73ebf0 # v5.0.0
+      uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
       with:
         path: |
           ${{ env.go_cache }}
@@ -160,7 +160,7 @@ jobs:
     - name: Save Cache of Build (only on main)
       id: cache-golang-save
       # Only save build cache once
-      uses: actions/cache/save@a7833574556fa59680c1b7cb190c1735db73ebf0 # v5.0.0
+      uses: actions/cache/save@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
       with:
         path: |
           ${{ env.go_cache }}
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 68df94970..cc4671189 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -132,7 +132,7 @@ jobs:
       uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
 
     - name: Download CTF
-      uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
       with:
         pattern: 'ctf-aggregated'
         path: gen/downloaded-ctfs
@@ -160,7 +160,7 @@ jobs:
     - name: Restore / Reuse Cache from central build
       id: cache-golang-restore
       # Only Restore, not build another cache (too big)
-      uses: actions/cache/restore@a7833574556fa59680c1b7cb190c1735db73ebf0 # v5.0.0
+      uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
       with:
         path: |
           ${{ env.go_cache }}