diff --git a/.github/workflows/build-linux-armv7l.yml b/.github/workflows/build-linux-armv7l.yml
index 9e0c3c437..c319d77ca 100644
--- a/.github/workflows/build-linux-armv7l.yml
+++ b/.github/workflows/build-linux-armv7l.yml
@@ -17,7 +17,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: run VM
-        uses: uraimo/run-on-arch-action@460cb8e6d9f726a588fc9b5e681c8a6cab09ae41 # v3.2.0
+        uses: uraimo/run-on-arch-action@fa1f3e7de95534497266c7265950b5188355fbfb # v3.2.1
         id: runcmd
         with:
           arch: armv7
diff --git a/.github/workflows/build-linux-hosts.yml b/.github/workflows/build-linux-hosts.yml
index 092a77ca6..b4c4761e9 100644
--- a/.github/workflows/build-linux-hosts.yml
+++ b/.github/workflows/build-linux-hosts.yml
@@ -52,7 +52,7 @@ jobs:
 
       - name: Initialize CodeQL
         if: inputs.arch == 'amd64'
-        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
         with:
           languages: c
 
@@ -64,7 +64,7 @@ jobs:
 
       - name: perform CodeQL analysis
         if: inputs.arch == 'amd64'
-        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
+        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
 
       - name: list features
         run: ./fastfetch --list-features
diff --git a/.github/workflows/build-linux-vms.yml b/.github/workflows/build-linux-vms.yml
index 82dffbea7..2bfcf1359 100644
--- a/.github/workflows/build-linux-vms.yml
+++ b/.github/workflows/build-linux-vms.yml
@@ -21,7 +21,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: run VM
-        uses: uraimo/run-on-arch-action@460cb8e6d9f726a588fc9b5e681c8a6cab09ae41 # v3.2.0
+        uses: uraimo/run-on-arch-action@fa1f3e7de95534497266c7265950b5188355fbfb # v3.2.1
         id: runcmd
         with:
           arch: ${{ inputs.arch }}
diff --git a/.github/workflows/build-solaris-amd64.yml b/.github/workflows/build-solaris-amd64.yml
index e8fcc7056..b0e77d72d 100644
--- a/.github/workflows/build-solaris-amd64.yml
+++ b/.github/workflows/build-solaris-amd64.yml
@@ -17,7 +17,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: run VM
-        uses: vmactions/solaris-vm@a11f407d3720a3717673d4194f19ee63b284977e # v1.4.0
+        uses: vmactions/solaris-vm@87d3c436511cef802cd1637f86f73b1a97715c8c # v1.4.1
         with:
           usesh: true
           envs: 'CMAKE_BUILD_TYPE'
diff --git a/.github/workflows/build-windows-hosts.yml b/.github/workflows/build-windows-hosts.yml
index c7c47f9d5..888fac47a 100644
--- a/.github/workflows/build-windows-hosts.yml
+++ b/.github/workflows/build-windows-hosts.yml
@@ -45,7 +45,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: setup-msys2
-        uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2.32.0
+        uses: msys2/setup-msys2@ec48f7c5447b3140e2b088413ae3a55687bccb6e # v2.33.0
         with:
           msystem: ${{ inputs.msystem }}
           update: true
@@ -117,7 +117,7 @@ jobs:
       - if: github.event_name == 'push' && github.repository == 'fastfetch-cli/fastfetch'
         name: submit signing request
         # https://github.com/SignPath/github-action-submit-signing-request/issues/18
-        uses: signpath/github-action-submit-signing-request@c92b958760219087e01f8d67a1669ed57afe2627 # v2.3
+        uses: signpath/github-action-submit-signing-request@f6d04783b4569d051e0c80105fe66e82819d0092 # v3.0
         with:
           api-token: '${{ secrets.SIGNPATH_API_TOKEN }}'
           organization-id: '${{ vars.SIGNPATH_ORG_ID }}'