diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 195cbbf..fd26b2b 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -48,7 +48,7 @@ jobs:
 
       - name: Upload coverage to Codecov
         if: env.CODECOV_TOKEN != ''
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f
+        uses: codecov/codecov-action@0b35c9ecc4f0529d0eb674914510c22f85b196b4
         with:
           token: ${{ env.CODECOV_TOKEN }}
           files: runtime/coverage/clover.xml
diff --git a/.github/workflows/package-static.yml b/.github/workflows/package-static.yml
index 021a1fd..7bfd502 100644
--- a/.github/workflows/package-static.yml
+++ b/.github/workflows/package-static.yml
@@ -33,7 +33,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e
+        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003
 
       - name: Log in to Container Registry
         if: github.event_name != 'pull_request' && github.ref == 'refs/heads/master'
@@ -53,7 +53,7 @@ jobs:
             type=sha,prefix=nightly-,enable={{is_default_branch}}
 
       - name: Build Linux and PHAR artifacts
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc
         with:
           context: .
           file: ./docker/Dockerfile
@@ -83,7 +83,7 @@ jobs:
           if-no-files-found: error
 
       - name: Build and push distroless image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc
         with:
           context: .
           file: ./docker/Dockerfile.distroless-binary
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 55700d3..b872611 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -28,10 +28,10 @@ jobs:
           persist-credentials: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e
+        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003
 
       - name: Build Linux and PHAR artifacts
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc
         env:
           DOCKER_BUILD_RECORD_UPLOAD: false
         with:
@@ -173,7 +173,7 @@ jobs:
           path: dist/linux-amd64
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e
+        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003
 
       - name: Log in to Container Registry
         uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f
@@ -194,7 +194,7 @@ jobs:
             type=semver,pattern={{major}}
 
       - name: Build and push binary-only distroless image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc
         env:
           DOCKER_BUILD_RECORD_UPLOAD: false
         with:
diff --git a/.github/workflows/run-tests.yml b/.github/workflows/run-tests.yml
index 5c8114a..91e1cbc 100644
--- a/.github/workflows/run-tests.yml
+++ b/.github/workflows/run-tests.yml
@@ -74,10 +74,10 @@ jobs:
           persist-credentials: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e
+        uses: docker/setup-buildx-action@594f3bf4285d9ea8dc53c9a0c9c4092420091003
 
       - name: Build test Docker image
-        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc
         with:
           context: .
           file: ./docker/Dockerfile
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 4c43539..581f4c4 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -32,7 +32,7 @@ jobs:
           persist-credentials: false
 
       - name: Analyse workflows
-        uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
         with:
           advanced-security: true
           annotations: false