diff --git a/.github/workflows/assets.yml b/.github/workflows/assets.yml
index 14a65ae..6e7e7ef 100644
--- a/.github/workflows/assets.yml
+++ b/.github/workflows/assets.yml
@@ -85,11 +85,11 @@ jobs:
         run: cargo run -p xtask -- assets fetch
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5
 
       - name: Build WASIX builder image and save cache
         if: ${{ github.ref == 'refs/heads/main' }}
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
         with:
           context: assets/wasix-build/docker
           file: assets/wasix-build/docker/Dockerfile
@@ -100,7 +100,7 @@ jobs:
 
       - name: Build WASIX builder image
         if: ${{ github.ref != 'refs/heads/main' }}
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf
         with:
           context: assets/wasix-build/docker
           file: assets/wasix-build/docker/Dockerfile
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 72091ff..fc7acce 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -93,7 +93,7 @@ jobs:
         uses: raven-actions/actionlint@205b530c5d9fa8f44ae9ed59f341a0db994aa6f8
 
       - name: Audit GitHub Actions workflows
-        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e
+        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d
         with:
           advanced-security: false
           config: .github/zizmor.yml
@@ -279,7 +279,7 @@ jobs:
             examples/tauri-sqlx-vanilla/src-tauri -> target
 
       - name: Install Node.js
-        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
         with:
           node-version: 22
           cache: npm
@@ -362,7 +362,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Check dependency policy
-        uses: EmbarkStudios/cargo-deny-action@91bf2b620e09e18d6eb78b92e7861937469acedb
+        uses: EmbarkStudios/cargo-deny-action@a531616d8ce3b9177443e48a1159bc945a099823
 
   required:
     name: Required checks
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a5cf23e..a82503a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -56,7 +56,7 @@ jobs:
 
       - name: Create or update release PR
         id: release_plz_pr
-        uses: release-plz/action@1528104d2ca23787631a1c1f022abb64b34c1e11
+        uses: release-plz/action@064f4d1e36c843611ddf013be726beaa4ad804db
         with:
           command: release-pr
         env:
@@ -151,7 +151,7 @@ jobs:
       - name: Publish with release-plz
         if: ${{ inputs.operation == 'publish' }}
         id: release_plz_publish
-        uses: release-plz/action@1528104d2ca23787631a1c1f022abb64b34c1e11
+        uses: release-plz/action@064f4d1e36c843611ddf013be726beaa4ad804db
         with:
           command: release
           manifest_path: target/pglite-oxide/release/workspace/Cargo.toml