diff --git a/.github/workflows/call-github2gerrit.yaml b/.github/workflows/call-github2gerrit.yaml
index 4c4d9ae06ce..fa9ee8891e6 100644
--- a/.github/workflows/call-github2gerrit.yaml
+++ b/.github/workflows/call-github2gerrit.yaml
@@ -33,7 +33,7 @@ jobs:
     steps:
       - name: Convert GitHub PR to Gerrit Change
         # yamllint disable-line rule:line-length
-        uses: lfreleng-actions/github2gerrit-action@f2ffe06d3ec444fb4ebff0f40362660380490513 # v2.4.3
+        uses: lfreleng-actions/github2gerrit-action@bb821bec1b2846cd3ab51bac095495bcf9c9abc6 # v2.4.4
         with:
           GERRIT_SSH_PRIVKEY_G2G: ${{ secrets.GERRIT_SSH_PRIVKEY_G2G }}
           GERRIT_KNOWN_HOSTS: ${{ vars.GERRIT_KNOWN_HOSTS }}
diff --git a/.github/workflows/clm-scan.yaml b/.github/workflows/clm-scan.yaml
index 19ce8d3204d..c1339016abf 100644
--- a/.github/workflows/clm-scan.yaml
+++ b/.github/workflows/clm-scan.yaml
@@ -40,7 +40,7 @@ jobs:
 
       - name: Setup Java
         # yamllint disable-line rule:line-length
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: "temurin"
           java-version: "21"
diff --git a/.github/workflows/gerrit-sonar.yaml b/.github/workflows/gerrit-sonar.yaml
index 3996f637ab1..c74416c32bd 100644
--- a/.github/workflows/gerrit-sonar.yaml
+++ b/.github/workflows/gerrit-sonar.yaml
@@ -60,7 +60,7 @@ jobs:
     permissions:
       contents: read
     # yamllint disable-line rule:line-length
-    uses: lfreleng-actions/security-workflows/.github/workflows/sonarqube-cloud.yaml@6c2ced2c9310a4f2606ad29a464e9f2d8fd397b8 # v0.9.3
+    uses: lfreleng-actions/security-workflows/.github/workflows/sonarqube-cloud.yaml@179b57cc41fbdae90d68237b418539d33e5ba091 # v0.9.4
     with:
       # Gerrit dispatches carry a refspec and check out the change;
       # the weekly schedule leaves it empty and takes the branch.