diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 29013db..9abab16 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -22,6 +22,6 @@ jobs:
           egress-policy: audit
 
       - name: 'Checkout Repository'
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: 'Dependency Review'
         uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v5.0.0
diff --git a/.github/workflows/lf-build-linux-x86_64.yml b/.github/workflows/lf-build-linux-x86_64.yml
index 832273b..810f13f 100644
--- a/.github/workflows/lf-build-linux-x86_64.yml
+++ b/.github/workflows/lf-build-linux-x86_64.yml
@@ -39,12 +39,12 @@ jobs:
       distro_list: '${{ steps.set-matrix.outputs.distro_list }}'
     steps:
       - name: 'Harden the runner (Audit all outbound calls)'
-        uses: 'step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411' # v2.19.4
+        uses: 'step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920' # v2.20.0
         with:
           egress-policy: 'audit'
 
       - name: 'git clone https://github.com/Linuxfabrik/packaging'
-        uses: 'actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10' # v6.0.3
+        uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # v7.0.1
 
       - id: 'set-matrix'
         run: |
@@ -72,7 +72,7 @@ jobs:
         distro: '${{ fromJson(needs.prepare-matrix.outputs.distro_list) }}'
     steps:
       - name: 'Harden the runner (Audit all outbound calls)'
-        uses: 'step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411' # v2.19.4
+        uses: 'step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920' # v2.20.0
         with:
           egress-policy: 'audit'
 
@@ -87,7 +87,7 @@ jobs:
           echo "PKG_DIR_PACKAGED=$RUNNER_TEMP/packaged" >> "$GITHUB_ENV"
 
       - name: 'git clone https://github.com/Linuxfabrik/packaging'
-        uses: 'actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10' # v6.0.3
+        uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # v7.0.1
 
       - name: 'Create working directories'
         run: 'mkdir -p "$PKG_DIR_PACKAGED"'
diff --git a/.github/workflows/lf-check-upstream.yml b/.github/workflows/lf-check-upstream.yml
index 33d7570..5175af1 100644
--- a/.github/workflows/lf-check-upstream.yml
+++ b/.github/workflows/lf-check-upstream.yml
@@ -18,12 +18,12 @@ jobs:
       pull-requests: 'write'
     steps:
       - name: 'Harden the runner (Audit all outbound calls)'
-        uses: 'step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411' # v2.19.4
+        uses: 'step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920' # v2.20.0
         with:
           egress-policy: 'audit'
 
       - name: 'git clone https://github.com/Linuxfabrik/packaging'
-        uses: 'actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10' # v6.0.3
+        uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # v7.0.1
 
       - name: 'Open a version-bump PR for every package behind its upstream'
         env:
diff --git a/.github/workflows/pre-commit-autoupdate.yml b/.github/workflows/pre-commit-autoupdate.yml
index ffe7b30..7acdcb7 100644
--- a/.github/workflows/pre-commit-autoupdate.yml
+++ b/.github/workflows/pre-commit-autoupdate.yml
@@ -19,12 +19,12 @@ jobs:
           private-key: '${{ secrets.LF_AUTOMATION_APP_PRIVATE_KEY }}'
 
       - name: 'Checkout repository'
-        uses: 'actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0' # v7.0.0
+        uses: 'actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1' # v7.0.1
         with:
           token: '${{ steps.app-token.outputs.token }}'
 
       - name: 'Set up Python'
-        uses: 'actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1' # v6
+        uses: 'actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97' # v7.0.0
         with:
           python-version: '3.12'
 
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 4140888..d267095 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -36,12 +36,12 @@ jobs:
           egress-policy: audit
 
       - name: "Checkout code"
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
         with:
           results_file: results.sarif
           results_format: sarif
@@ -72,6 +72,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v3.29.5
+        uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v3.29.5
         with:
           sarif_file: results.sarif