diff --git a/.github/workflows/actionlint.yaml b/.github/workflows/actionlint.yaml
index aa2e2de..430bdcc 100644
--- a/.github/workflows/actionlint.yaml
+++ b/.github/workflows/actionlint.yaml
@@ -23,7 +23,7 @@ jobs:
     name: Action lint
     runs-on: ubuntu-latest
     steps:
-      - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -40,7 +40,7 @@ jobs:
           mapfile -t yamls < <(find .github/workflows -name "*.y*ml" | grep -v dependabot.)
           echo "files=${yamls[*]}" >> "${GITHUB_OUTPUT}"
       - name: Action lint
-        uses: step-security/action-actionlint@c3aa382d371c6b05513ae5907d4f77713e21813c # v1.72.0
+        uses: step-security/action-actionlint@b90a9ddb65b752bc6b6888a2f30a4941d9ff62e5 # v1.73.1
         env:
           SHELLCHECK_OPTS: "--exclude=SC2129"
         with:
diff --git a/.github/workflows/c-i.yaml b/.github/workflows/c-i.yaml
index 6072d4f..540e066 100644
--- a/.github/workflows/c-i.yaml
+++ b/.github/workflows/c-i.yaml
@@ -23,14 +23,14 @@ jobs:
       contents: read
     runs-on: ubuntu-24.04-${{matrix.arch}}
     steps:
-      - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: chainguard-dev/actions/apt-faster@b2555de0cf9724fb9b49d050ff18bd1f49562ba7 # v1.6.29
-      - uses: chainguard-dev/actions/setup-melange@b2555de0cf9724fb9b49d050ff18bd1f49562ba7 # v1.6.29
+      - uses: chainguard-dev/actions/apt-faster@0ffab11a71c1b7bd68ddf94665a8ec88b116223d # v1.6.33
+      - uses: chainguard-dev/actions/setup-melange@0ffab11a71c1b7bd68ddf94665a8ec88b116223d # v1.6.33
       - name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml
index 6ee55c2..3690fbf 100644
--- a/.github/workflows/zizmor.yaml
+++ b/.github/workflows/zizmor.yaml
@@ -25,7 +25,7 @@ jobs:
       contents: read # Clone the repository
       security-events: write # Upload SARIF results to Code Scanning
     steps:
-      - uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      - uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -36,4 +36,4 @@ jobs:
         with:
           persist-credentials: false
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+        uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3