diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 3e73859ed6..50daf3b521 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -55,4 +55,4 @@ jobs:
         # Some tests are especially flakey in coverage tests. That's fine. We
         # only really care to measure how much of our codebase is covered.
         continue-on-error: true
-      - uses: codecov/codecov-action@5ecb98a3c6b747ed38dc09f787459979aebb39be
+      - uses: codecov/codecov-action@015f24e6818733317a2da2edd6290ab26238649a
diff --git a/.github/workflows/markdown.yml b/.github/workflows/markdown.yml
index 0e8759000c..e01432032b 100644
--- a/.github/workflows/markdown.yml
+++ b/.github/workflows/markdown.yml
@@ -15,6 +15,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@44c2b7a8a4ea60a981eaca3cf939b5f4305c123b
-      - uses: DavidAnson/markdownlint-cli2-action@b4c9feab76d8025d1e83c653fa3990936df0e6c8
+      - uses: DavidAnson/markdownlint-cli2-action@eb5ca3ab411449c66620fe7f1b3c9e10547144b0
         with:
             globs: "**/*.md"
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index ab2594bb7b..5db3506ce6 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -95,7 +95,7 @@ jobs:
       - uses: Swatinem/rust-cache@23bce251a8cd2ffc3c1075eaa2367cf899916d84
       - run: just fetch
       - name: Run cargo deny check bans licenses sources
-        uses: EmbarkStudios/cargo-deny-action@3f4a782664881cf5725d0ffd23969fcce89fd868
+        uses: EmbarkStudios/cargo-deny-action@13fd9ef18c30518efe066a8ac36cd629cc377507
         with:
           command: check bans licenses sources
       - run: just check-fmt
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6d0d8b3105..4a5fa62510 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -150,7 +150,7 @@ jobs:
       - run: just arch=${{ matrix.arch }} libc=${{ matrix.libc }} rustup
       - run: just arch=${{ matrix.arch }} libc=${{ matrix.libc }} profile=${{ needs.meta.outputs.profile }} build
       - run: just arch=${{ matrix.arch }} libc=${{ matrix.libc }} profile=${{ needs.meta.outputs.profile }} package
-      - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808
+      - uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882
         with:
           name: ${{ matrix.arch }}-artifacts
           path: target/package/*
@@ -180,7 +180,7 @@ jobs:
           ref: ${{ needs.meta.outputs.ref }}
       - run: git tag -a -m "$VERSION" "$TAG"
       # Fetch the artifacts.
-      - uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e
+      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16
         with:
           path: artifacts
       - run: du -h artifacts/**/*
@@ -188,7 +188,7 @@ jobs:
       - if: needs.meta.outputs.publish == 'true'
         run: git push origin "$TAG"
       - if: needs.meta.outputs.publish == 'true'
-        uses: softprops/action-gh-release@69320dbe05506a9a39fc8ae11030b214ec2d1f87
+        uses: softprops/action-gh-release@01570a1f39cb168c169c802c3bceb9e93fb10974
         with:
           name: ${{ env.VERSION }}
           tag_name: ${{ env.TAG }}