diff --git a/.github/workflows/release-kernel.yml b/.github/workflows/release-kernel.yml
index 814ad36..70f2687 100644
--- a/.github/workflows/release-kernel.yml
+++ b/.github/workflows/release-kernel.yml
@@ -30,7 +30,7 @@ jobs:
     env:
       REF_NAME: ${{ github.ref_name }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # actions-rust-lang/setup-rust-toolchain respects rust-toolchain.toml,
       # so the channel is whatever's pinned there (currently
@@ -65,7 +65,7 @@ jobs:
       # with: `gh attestation verify <file> --owner cyphera-labs`.
       - name: Attest kernel ELF build provenance
         id: attest
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v3.0.0
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v3.0.0
         with:
           subject-path: dist/cyphera-kernel-*.elf
 
diff --git a/.github/workflows/sbom.yml b/.github/workflows/sbom.yml
index feef42c..650fb9d 100644
--- a/.github/workflows/sbom.yml
+++ b/.github/workflows/sbom.yml
@@ -26,19 +26,19 @@ jobs:
       # script so it can't be parsed as shell.
       REF_NAME: ${{ github.ref_name }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # syft natively understands Cargo.lock and emits CycloneDX + SPDX
       # from a single binary; faster than `cargo cyclonedx` (no compile).
       - name: Generate CycloneDX SBOM
-        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
         with:
           format: cyclonedx-json
           artifact-name: cyphera-kernel-${{ github.ref_name }}-sbom.cdx.json
           output-file: cyphera-kernel-${{ github.ref_name }}-sbom.cdx.json
 
       - name: Generate SPDX SBOM
-        uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
+        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
         with:
           format: spdx-json
           artifact-name: cyphera-kernel-${{ github.ref_name }}-sbom.spdx.json
@@ -50,7 +50,7 @@ jobs:
       # `gh attestation verify <file> --owner cyphera-labs`.
       - name: Attest SBOM build provenance
         id: attest
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v3.0.0
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v3.0.0
         with:
           subject-path: 'cyphera-kernel-*-sbom.*.json'
 
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 858bba8..21a36c5 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # nightly
         with:
@@ -45,7 +45,7 @@ jobs:
           components: rust-src
           targets: x86_64-unknown-none
 
-      - uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # post-v2.9.1
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # post-v2.9.2
         with:
           key: tests