diff --git a/.github/workflows/sign-image.yml b/.github/workflows/sign-image.yml
index ab99110..04857f8 100644
--- a/.github/workflows/sign-image.yml
+++ b/.github/workflows/sign-image.yml
@@ -113,7 +113,7 @@ jobs:
           ignore-unfixed: false
 
       - name: Upload vulnerability scan
-        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           sarif_file: trivy-results.sarif
 
@@ -127,7 +127,7 @@ jobs:
           ignore-unfixed: true
 
       - name: Login to GHCR
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ vars.GHCR_PACKAGE_USERNAME || github.actor }}
diff --git a/.github/workflows/verify-image.yml b/.github/workflows/verify-image.yml
index 1a5a646..6c6dec6 100644
--- a/.github/workflows/verify-image.yml
+++ b/.github/workflows/verify-image.yml
@@ -114,7 +114,7 @@ jobs:
           ignore-unfixed: false
 
       - name: Upload vulnerability scan
-        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
         with:
           sarif_file: trivy-results.sarif