diff --git a/.github/workflows/cds-extractor-dist-bundle.yml b/.github/workflows/cds-extractor-dist-bundle.yml
index 1e43bead6..9003dfeb9 100644
--- a/.github/workflows/cds-extractor-dist-bundle.yml
+++ b/.github/workflows/cds-extractor-dist-bundle.yml
@@ -25,7 +25,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
         with:
           node-version: '20'
           cache: 'npm'
diff --git a/.github/workflows/codeql-ql.yml b/.github/workflows/codeql-ql.yml
index cd00f30ae..d04aafee9 100644
--- a/.github/workflows/codeql-ql.yml
+++ b/.github/workflows/codeql-ql.yml
@@ -12,5 +12,5 @@ permissions:
 
 jobs:
   codeql:
-    uses: advanced-security/reusable-workflows/.github/workflows/codeql-ql.yml@2028787a231ffa7d5445cfbf3d63db40b6131489 # main
+    uses: advanced-security/reusable-workflows/.github/workflows/codeql-ql.yml@cdb58ebdac3e974822957b34c90394db7dd44ccc # main
     secrets: inherit
diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index d37a5f241..cfbdbe0a1 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -35,7 +35,7 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Copilot Setup - Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
         with:
           cache: 'npm'
           cache-dependency-path: 'extractors/cds/tools/package-lock.json'
@@ -52,7 +52,7 @@ jobs:
           echo "Generated .codeql-version: $(cat .codeql-version)"
 
       - name: Copilot Setup - Setup CodeQL environment
-        uses: advanced-security/codeql-development-mcp-server/.github/actions/setup-codeql-environment@b3a4b770e475ffc8f974830d084a51b417ead8ae # main
+        uses: advanced-security/codeql-development-mcp-server/.github/actions/setup-codeql-environment@65a6c42e9017991a8b298814c329021b3274bfc6 # main
         with:
           install-language-runtimes: false
 
diff --git a/.github/workflows/ql-unit-tests-linux.yml b/.github/workflows/ql-unit-tests-linux.yml
index 9e83418e6..7d46114f9 100644
--- a/.github/workflows/ql-unit-tests-linux.yml
+++ b/.github/workflows/ql-unit-tests-linux.yml
@@ -80,7 +80,7 @@ jobs:
           qlt query run install-packs
 
       - name: Setup Node.js for CDS compilation
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
         with:
           node-version: '20'
           cache: 'npm'
diff --git a/.github/workflows/ql-unit-tests-windows.yml b/.github/workflows/ql-unit-tests-windows.yml
index 46884ae64..b46a27543 100644
--- a/.github/workflows/ql-unit-tests-windows.yml
+++ b/.github/workflows/ql-unit-tests-windows.yml
@@ -155,7 +155,7 @@ jobs:
           Write-Host "QL pack installation complete"
 
       - name: Setup Node.js for CDS compilation
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
         with:
           node-version: "22"
           cache: "npm"
diff --git a/.github/workflows/release-tag.yml b/.github/workflows/release-tag.yml
index bd9e86c77..f731c669b 100644
--- a/.github/workflows/release-tag.yml
+++ b/.github/workflows/release-tag.yml
@@ -149,7 +149,7 @@ jobs:
 
       - name: Tag - Setup Node.js for CDS compilation
         if: steps.needs-creation.outputs.needed == 'true'
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
         with:
           node-version: '20'
           cache: 'npm'
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 750aa0cb8..e6908ad90 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -136,7 +136,7 @@ jobs:
           path: dist-packs
 
       - name: Release - Create GitHub Release
-        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           files: |
             dist-packs/*.tar.gz
diff --git a/.github/workflows/update-codeql.yml b/.github/workflows/update-codeql.yml
index a0f6608ad..df04b934d 100644
--- a/.github/workflows/update-codeql.yml
+++ b/.github/workflows/update-codeql.yml
@@ -130,7 +130,7 @@ jobs:
         run: ./scripts/upgrade-packs.sh
 
       - name: Update - Setup Node.js for CDS compilation
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
         with:
           node-version: '20'
           cache: 'npm'