diff --git a/.github/workflows/fork-coverage.yml b/.github/workflows/fork-coverage.yml
index f2c5c1cc..4c80988a 100644
--- a/.github/workflows/fork-coverage.yml
+++ b/.github/workflows/fork-coverage.yml
@@ -69,7 +69,7 @@ jobs:
 
       - name: Publish fork PR test coverage to Codecov
         if: env.CODECOV_TOKEN != '' && github.event.workflow_run.conclusion == 'success'
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+        uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: codecov-payload/jacoco.xml,codecov-payload/jacoco-aggregate.xml
diff --git a/.github/workflows/fork-sonar.yml b/.github/workflows/fork-sonar.yml
index 1ef29ae3..f6b5b7cf 100644
--- a/.github/workflows/fork-sonar.yml
+++ b/.github/workflows/fork-sonar.yml
@@ -164,7 +164,7 @@ jobs:
 
       - name: Publish fork PR analysis to SonarCloud
         if: env.SONAR_TOKEN != ''
-        uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8.2.1
+        uses: SonarSource/sonarqube-scan-action@ba9859eae8dd6bd29e412f25ddbbef3d032000f4 # v8.2.2
         env:
           SONAR_HOST_URL: https://sonarcloud.io
         with:
diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml
index 4a9aa5cb..1bc5415b 100644
--- a/.github/workflows/maven.yml
+++ b/.github/workflows/maven.yml
@@ -197,7 +197,7 @@ jobs:
     - name: Upload coverage to Codecov (processor + core via aggregate)
       # Skip when CODECOV_TOKEN is unavailable (fork PRs) and for any bot-authored PR.
       if: always() && env.CODECOV_TOKEN != '' && github.event.pull_request.user.type != 'Bot'
-      uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
+      uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
       with:
         fail_ci_if_error: true
         files: |