diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 06feae6..53d46da 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -128,7 +128,7 @@ jobs:
         run: go test ./... -race -count=1 -covermode=atomic -coverprofile=coverage.out
       - name: Покрытие
         run: go tool cover -func=coverage.out | tail -n 1
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: coverage-${{ matrix.tool }}
@@ -162,7 +162,7 @@ jobs:
           go build -trimpath -ldflags="-s -w -X main.version=${GITHUB_SHA::7}" -o bin/${{ matrix.tool }} ./cmd/${{ matrix.tool }}
           ./bin/${{ matrix.tool }} --version
           ./bin/${{ matrix.tool }} --help
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ matrix.tool }}-linux-amd64
           path: ${{ matrix.dir }}/bin/${{ matrix.tool }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index c8d4ba7..4db93cc 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -45,7 +45,7 @@ jobs:
           go-version-file: ${{ matrix.dir }}/go.mod
           cache-dependency-path: ${{ matrix.dir }}/go.sum
       - name: Инициализировать CodeQL
-        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
         with:
           languages: go
           # Модуль лежит во вложенном каталоге, поэтому сборку задаём вручную:
@@ -55,7 +55,7 @@ jobs:
         working-directory: ${{ matrix.dir }}
         run: go build -o "${RUNNER_TEMP}/codeql-build/" ./...
       - name: Анализ CodeQL
-        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/analyze@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
         with:
           # Категория уникальна для каждого модуля: с одинаковой категорией отчёты
           # инструментов перекрывали бы друг друга в GitHub Security.
diff --git a/.github/workflows/release-binaries.yml b/.github/workflows/release-binaries.yml
index 9eade74..4a93813 100644
--- a/.github/workflows/release-binaries.yml
+++ b/.github/workflows/release-binaries.yml
@@ -76,7 +76,7 @@ jobs:
           # Кавычки внутри скрипта: подстановка $TOOL без них — находка shellcheck SC2086.
           "./dist/${TOOL}-linux-amd64" --version
       - name: SBOM бинарей (CycloneDX)
-        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
+        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
         with:
           path: "${{ inputs.dir }}/dist"
           format: cyclonedx-json
diff --git a/.github/workflows/release-image.yml b/.github/workflows/release-image.yml
index 2f681c5..7b9bdfd 100644
--- a/.github/workflows/release-image.yml
+++ b/.github/workflows/release-image.yml
@@ -83,7 +83,7 @@ jobs:
           TAG_PREFIX: ${{ inputs.tag_prefix }}
         run: docker buildx imagetools inspect "${IMAGE}:${GITHUB_REF_NAME#"${TAG_PREFIX}"}"
       - name: Установить cosign
-        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+        uses: sigstore/cosign-installer@756fe2d284c7292c4e9b62c8a28f1e5629c59532 # v4.1.3
       - name: Подписать образ (keyless)
         env:
           IMAGE: ghcr.io/devops-spb-ru/${{ inputs.tool }}
diff --git a/.github/workflows/trivy-scan.yml b/.github/workflows/trivy-scan.yml
index 64b201a..2a7c016 100644
--- a/.github/workflows/trivy-scan.yml
+++ b/.github/workflows/trivy-scan.yml
@@ -72,7 +72,7 @@ jobs:
         # В PR из форка токен не имеет права писать в Security: загрузку пропускаем,
         # сама проверка ниже всё равно выполняется.
         if: always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
-        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/upload-sarif@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
         with:
           sarif_file: ${{ matrix.sarif }}
           category: trivy-image-${{ matrix.tool }}
@@ -137,7 +137,7 @@ jobs:
           exit-code: "0"
       - name: Загрузить отчёт в GitHub Security
         if: always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
-        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/upload-sarif@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
         with:
           sarif_file: trivy-fs.sarif
           # Категория уникальна для инструмента: иначе отчёты перекрывали бы друг друга.