diff --git a/.github/workflows/downstream-compatibility.yml b/.github/workflows/downstream-compatibility.yml
index 39c9a71a..d2fcafbc 100644
--- a/.github/workflows/downstream-compatibility.yml
+++ b/.github/workflows/downstream-compatibility.yml
@@ -124,7 +124,7 @@ jobs:
 
       - name: Set up Java
         if: matrix.runtime == 'java'
-        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
+        uses: actions/setup-java@b843ebf9b913146b38da2eaa7aeddf76074ae1ad # v6.1.0
         with:
           distribution: temurin
           java-version: "21"
@@ -133,7 +133,7 @@ jobs:
 
       - name: Set up Node.js
         if: matrix.runtime == 'node'
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: "24"
 
@@ -145,7 +145,7 @@ jobs:
 
       - name: Set up Ruby
         if: matrix.runtime == 'ruby'
-        uses: ruby/setup-ruby@a0102e0972be65f351c307e2d64b9314a57c8073 # v1.324.0
+        uses: ruby/setup-ruby@651ff0d62c5c79bed6d53ec518387aae20e72c1a # v1.329.0
         with:
           ruby-version: "3.4"
 
@@ -157,7 +157,7 @@ jobs:
 
       - name: Set up PHP
         if: matrix.runtime == 'php'
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2.37.2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2.40.0
         with:
           php-version: "8.3"
           coverage: none
@@ -204,7 +204,7 @@ jobs:
 
       - name: Upload comparison logs
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: downstream-compatibility-${{ matrix.slug }}
           path: ${{ runner.temp }}/downstream-conformance/${{ matrix.slug }}/*.log