diff --git a/.github/workflows/auto-label.yml b/.github/workflows/auto-label.yml
index b28295342..64fbc9169 100644
--- a/.github/workflows/auto-label.yml
+++ b/.github/workflows/auto-label.yml
@@ -14,6 +14,6 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - uses: release-drafter/release-drafter/autolabeler@563bf132657a13ded0b01fcb723c5a58cdd824e2
+      - uses: release-drafter/release-drafter/autolabeler@34d80673e067bdc0c24568d3af899c216adcfaa9
         with:
           config-name: release-drafter-config.yml
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index fcd6cc260..d071cf723 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -34,14 +34,14 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@3434fbbc53af0fe47685ef3897703b39ef77b5cb # ratchet:github/codeql-action/init@v4
+        uses: github/codeql-action/init@1cd4d01d58f636bbdbffbfd3c121b3446d07e9f3 # ratchet:github/codeql-action/init@v4
         with:
           languages: ${{ matrix.language }}
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@3434fbbc53af0fe47685ef3897703b39ef77b5cb # ratchet:github/codeql-action/autobuild@v4
+        uses: github/codeql-action/autobuild@1cd4d01d58f636bbdbffbfd3c121b3446d07e9f3 # ratchet:github/codeql-action/autobuild@v4
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@3434fbbc53af0fe47685ef3897703b39ef77b5cb # ratchet:github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@1cd4d01d58f636bbdbffbfd3c121b3446d07e9f3 # ratchet:github/codeql-action/analyze@v4
         with:
           category: '/language:${{matrix.language}}'
diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 413c62a60..98bf55538 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -30,7 +30,7 @@ jobs:
 
       - name: Log in to Docker Hub
         if: github.repository_owner == 'finos'
-        uses: docker/login-action@06fb636fac595d6fb4b28a5dfcb21a6f5091859c # v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4
         with:
           username: finos
           password: ${{ secrets.DOCKER_PASSWORD }}
diff --git a/.github/workflows/release-drafter.yml b/.github/workflows/release-drafter.yml
index b8ca62f64..d1c86c989 100644
--- a/.github/workflows/release-drafter.yml
+++ b/.github/workflows/release-drafter.yml
@@ -18,11 +18,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           egress-policy: audit
 
-      - uses: release-drafter/release-drafter@563bf132657a13ded0b01fcb723c5a58cdd824e2
+      - uses: release-drafter/release-drafter@34d80673e067bdc0c24568d3af899c216adcfaa9
         with:
           # Target the branch that triggered this run
           # Ex: "release/2.1" becomes the commitish for the draft
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 4a0962e5c..8035c060f 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -72,6 +72,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: 'Upload to code-scanning'
-        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
+        uses: github/codeql-action/upload-sarif@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.37.4
         with:
           sarif_file: results.sarif