diff --git a/.github/workflows/asciinema.yml b/.github/workflows/asciinema.yml
index 07b78615cb..1a828176ea 100644
--- a/.github/workflows/asciinema.yml
+++ b/.github/workflows/asciinema.yml
@@ -58,7 +58,7 @@ jobs:
         run: |
           curl -fsSL "${SYNC_IP}:8080/fifo/${SYNC_FIFO}/done/${SYNC_TICKET}"
       - name: Create PR
-        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # v7.0.5
+        uses: peter-evans/create-pull-request@67ccf781d68cd99b580ae25a5c18a1cc84ffff1f # v7.0.6
         with:
           title: "tools/asciinema: update screencast"
           commit-message: "tools/asciinema: update screencast"
diff --git a/.github/workflows/docs_publish.yml b/.github/workflows/docs_publish.yml
index 031c0f1a31..ad55801592 100644
--- a/.github/workflows/docs_publish.yml
+++ b/.github/workflows/docs_publish.yml
@@ -58,6 +58,6 @@ jobs:
           nix build -L --impure --expr "(builtins.getFlake \"git+file://$(pwd)?shallow=1\").outputs.legacyPackages.x86_64-linux.contrast-docs.override { docusaurusBaseUrl = \"contrast/pr-preview/pr-${{ github.event.number }}\"; }"
       - name: Deploy preview
         if: env.PREVIEW == 'true' && !github.event.pull_request.head.repo.fork
-        uses: rossjrw/pr-preview-action@430e3dfc1de8a8ae77e77d862d25676ef9db55d1 # v1.4.8
+        uses: rossjrw/pr-preview-action@85ebedd64d707ad74231271607ef09d4a965485b # v1.5.0
         with:
           source-dir: ./result
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index d3f906e2a1..c11ef656a1 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -86,7 +86,7 @@ jobs:
           nix run .#scripts.get-logs download workspace/e2e.namespace
       - name: Upload logs
         if: always()
-        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
+        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
         with:
           name: e2e_pod_logs-${{ inputs.platform }}-${{ inputs.test-name }}
           path: workspace/logs/export/logs
diff --git a/.github/workflows/e2e_aks_runtime.yml b/.github/workflows/e2e_aks_runtime.yml
index 0f383ba657..850dde7cbc 100644
--- a/.github/workflows/e2e_aks_runtime.yml
+++ b/.github/workflows/e2e_aks_runtime.yml
@@ -96,7 +96,7 @@ jobs:
           nix run .#scripts.get-logs download workspace/e2e.namespace
       - name: Upload logs
         if: always()
-        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
+        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
         with:
           name: e2e_pod_logs-AKS-CLH-SNP-aks-runtime
           path: workspace/logs/export/logs
diff --git a/.github/workflows/e2e_runtime-reproducibility.yml b/.github/workflows/e2e_runtime-reproducibility.yml
index bbe99b4137..984ac2ae63 100644
--- a/.github/workflows/e2e_runtime-reproducibility.yml
+++ b/.github/workflows/e2e_runtime-reproducibility.yml
@@ -43,17 +43,17 @@ jobs:
           rebuild_checksum="$(jq  -r '.manifests[0].digest' rebuild/index.json)"
           echo "$rebuild_checksum" > ${{ matrix.build-target }}-${{ matrix.os }}-rebuild_checksum.txt
       - name: Upload Build Artifacts
-        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
+        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
         with:
           name: ${{ matrix.build-target }}-${{ matrix.os }}
           path: result
       - name: Upload Build Artifacts (Rebuild)
-        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
+        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
         with:
           name: ${{ matrix.build-target }}-${{ matrix.os }}-rebuild
           path: rebuild
       - name: Upload checksums
-        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
+        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
         with:
           name: ${{ matrix.build-target }}-${{ matrix.os }}-checksums
           path: ${{ matrix.build-target }}-${{ matrix.os }}-*_checksum.txt
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 242e481735..631d02779b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -196,7 +196,7 @@ jobs:
           working-directory: contrast-main
           commit: false
       - name: Create PR
-        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # v7.0.5
+        uses: peter-evans/create-pull-request@67ccf781d68cd99b580ae25a5c18a1cc84ffff1f # v7.0.6
         with:
           title: Post ${{ needs.process-inputs.outputs.WITHOUT_V }} release updates to main
           body: |
@@ -296,7 +296,7 @@ jobs:
             echo "ghcr.io/edgelesssys/contrast/cryptsetup:latest=$cryptsetupImgTagged"
           } > image-replacements.txt
       - name: Upload image replacements file (for main branch PR)
-        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
+        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
         with:
           name: image-replacements.txt
           path: ./image-replacements.txt
@@ -333,7 +333,7 @@ jobs:
         run: |
           nix build -L .#cli-release
       - name: Upload release artifacts (for main branch PR)
-        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
+        uses: actions/upload-artifact@6f51ac03b9356f520e9adb1b1b7802705f340c2b # v4.5.0
         with:
           name: contrast-release-artifacts
           path: |
@@ -343,7 +343,7 @@ jobs:
             workspace/emojivoto-demo.yml
             workspace/mysql-demo.yml
       - name: Create draft release
-        uses: softprops/action-gh-release@01570a1f39cb168c169c802c3bceb9e93fb10974 # v2.1.0
+        uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v2.2.1
         with:
           draft: true
           generate_release_notes: true
diff --git a/.github/workflows/rpm_updates.yml b/.github/workflows/rpm_updates.yml
index f490cbfe14..baa372579e 100644
--- a/.github/workflows/rpm_updates.yml
+++ b/.github/workflows/rpm_updates.yml
@@ -22,7 +22,7 @@ jobs:
         run: |
           nix run .#rpm-pin-vendor -- kata-packages-uvm kata-packages-uvm-coco systemd libseccomp > packages/by-name/microsoft/kata-image/package-index.json
       - name: Create PR
-        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # v7.0.5
+        uses: peter-evans/create-pull-request@67ccf781d68cd99b580ae25a5c18a1cc84ffff1f # v7.0.6
         with:
           title: "deps: update pinned rpm packages"
           body: "Automated updated created by [rpm_updates workflow](https://github.com/edgelesssys/contrast/blob/main/.github/workflows/rpm_updates.yml)."