diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 66e66be6..cf8aaac5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -155,7 +155,7 @@ jobs:
         # Hard-fails the PR on any HIGH or CRITICAL finding that is not listed
         # in .trivyignore at the repo root. To accept a CVE, add it to that
         # file with a human-readable justification comment, not here.
-        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           image-ref: sencho:pr-test
           exit-code: '1'
@@ -184,7 +184,7 @@ jobs:
       # composite action's `skip-backend-build` input short-circuits its build
       # step when this artifact is already in place.
       - name: Download backend dist
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@v8
         with:
           name: backend-dist
           path: backend/dist
@@ -230,7 +230,7 @@ jobs:
       # steps below so we make exactly one /app/installations token call.
       - name: Generate GitHub App installation token
         id: app-token
-        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
@@ -284,7 +284,7 @@ jobs:
       # auto-revokes on post-step even when the gate below is false.
       - name: Generate GitHub App installation token
         id: app-token
-        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml
index 4c94563a..0c53d4ed 100644
--- a/.github/workflows/docker-publish.yml
+++ b/.github/workflows/docker-publish.yml
@@ -104,7 +104,7 @@ jobs:
         # Gates the release on the same HIGH/CRITICAL policy as the PR scan.
         # Entries in .trivyignore at the repo root are honored so the acknowledged
         # CVE list is the single source of truth across PR CI and release CI.
-        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1 # v0.35.0
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           image-ref: localhost/sencho:release-scan
           exit-code: '1'
diff --git a/.github/workflows/release-blog-scaffold.yml b/.github/workflows/release-blog-scaffold.yml
index 8fac3af2..a076326f 100644
--- a/.github/workflows/release-blog-scaffold.yml
+++ b/.github/workflows/release-blog-scaffold.yml
@@ -28,7 +28,7 @@ jobs:
       # must include both Sencho and sencho-website for the push + PR to work.
       - name: Generate GitHub App installation token
         id: app-token
-        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index ba412b36..7c8aafdf 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -22,7 +22,7 @@ jobs:
       #     tag push from release-please still cascades to docker-publish.yml
       - name: Generate GitHub App installation token
         id: app-token
-        uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
+        uses: actions/create-github-app-token@1b10c78c7865c340bc4f6099eb2f838309f1e8c3 # v3.1.1
         with:
           app-id: ${{ secrets.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
@@ -31,7 +31,7 @@ jobs:
           permission-contents: write
           permission-pull-requests: write
 
-      - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4.4.0
+      - uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4.4.1
         with:
           token: ${{ steps.app-token.outputs.token }}
           config-file: release-please-config.json