diff --git a/.github/workflows/attest-release.yml b/.github/workflows/attest-release.yml
index f583263..8ee3119 100644
--- a/.github/workflows/attest-release.yml
+++ b/.github/workflows/attest-release.yml
@@ -74,7 +74,7 @@ jobs:
             --checksums dist/SHA256SUMS.txt
 
       - name: Attest verified release assets
-        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
         with:
           subject-path: |
             dist/SwanSong-${{ env.VERSION }}-macOS-universal.zip
@@ -84,7 +84,7 @@ jobs:
             dist/SHA256SUMS.txt
 
       - name: Attach the SPDX inventory to the app archive
-        uses: actions/attest-sbom@4651f806c01d8637787e274ac3bdf724ef169f34 # v3
+        uses: actions/attest-sbom@c604332985a26aa8cf1bdc465b92731239ec6b9e # v4.1.0
         with:
           subject-path: dist/SwanSong-${{ env.VERSION }}-macOS-universal.zip
           sbom-path: dist/SwanSong-${{ env.VERSION }}.spdx.json
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 9688e5e..845c60e 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -34,7 +34,7 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4
+        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
         with:
           languages: ${{ matrix.language }}
           build-mode: manual
@@ -49,6 +49,6 @@ jobs:
             --product SwanSongChecks
 
       - name: Analyze
-        uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4
+        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/publish-sparkle-appcast.yml b/.github/workflows/publish-sparkle-appcast.yml
index 5f6806f..0c2f11a 100644
--- a/.github/workflows/publish-sparkle-appcast.yml
+++ b/.github/workflows/publish-sparkle-appcast.yml
@@ -41,7 +41,7 @@ jobs:
 
     steps:
       - name: Check out reviewed main
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index 34c09bd..7393066 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -24,7 +24,7 @@ jobs:
       tests: ${{ steps.classify.outputs.tests }}
     steps:
       - name: Check out exact source
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 0
@@ -115,13 +115,13 @@ jobs:
 
       - name: Check out exact source
         if: env.RUN_TESTS == 'true'
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Check out locked SwanSong SDK source
         if: env.RUN_TESTS == 'true'
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: RegionallyFamous/swansong-sdk
           ref: f9bab7451593d0d8640816c60e0836377c65027e
@@ -223,13 +223,13 @@ jobs:
 
       - name: Check out exact source
         if: env.RUN_PREFLIGHT == 'true'
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Check out locked SwanSong SDK source
         if: env.RUN_PREFLIGHT == 'true'
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: RegionallyFamous/swansong-sdk
           ref: f9bab7451593d0d8640816c60e0836377c65027e