diff --git a/.github/workflows/claude-code-review.yml b/.github/workflows/claude-code-review.yml
index a7ff81c..1c8d3a1 100644
--- a/.github/workflows/claude-code-review.yml
+++ b/.github/workflows/claude-code-review.yml
@@ -28,7 +28,7 @@ jobs:
 
       - name: Run Claude Security Analysis
         id: claude-review
-        uses: anthropics/claude-code-action@d5726de019ec4498aa667642bc3a80fca83aa102
+        uses: anthropics/claude-code-action@be7b93b1907a4abad570368f3c74b6fe3807510b
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           show_full_output: "false"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 34a2fb1..9b31ff9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -47,10 +47,10 @@ jobs:
         run: npm install --no-save semantic-release@24 @semantic-release/commit-analyzer @semantic-release/release-notes-generator @semantic-release/github conventional-changelog-conventionalcommits
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c
 
       - name: Semantic Version
         id: semver
@@ -64,7 +64,7 @@ jobs:
 
       - name: Login to GitHub Container Registry
         if: steps.semver.outputs.new_release_published == 'true'
-        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -76,7 +76,7 @@ jobs:
 
       - name: Run GoReleaser
         if: steps.semver.outputs.new_release_published == 'true'
-        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94
         with:
           distribution: goreleaser
           version: "~> v2"
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 8c3ea4f..8539480 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -68,6 +68,6 @@ jobs:
           cache: true
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a
         with:
           version: v2.12.2
diff --git a/.github/workflows/todo.yml b/.github/workflows/todo.yml
index 412c923..c37496a 100644
--- a/.github/workflows/todo.yml
+++ b/.github/workflows/todo.yml
@@ -18,7 +18,7 @@ jobs:
         uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
 
       - name: TODO to Issue
-        uses: alstr/todo-to-issue-action@64aca8fda7023259aada83ba44ad988c4c443657
+        uses: alstr/todo-to-issue-action@37bb7b56e58569ef273b60678048030a7f0c261a
         with:
           IDENTIFIERS: '[{"name": "TODO", "labels": ["todo"]}, {"name": "FIXME", "labels": ["bug", "priority"]}, {"name": "HACK", "labels": ["tech-debt"]}, {"name": "OPTIMIZE", "labels": ["performance"]}]'
           CLOSE_ISSUES: true