diff --git a/.github/workflows/build-submit-android.yml b/.github/workflows/build-submit-android.yml
index 54f8723beb..cadf1c16dd 100644
--- a/.github/workflows/build-submit-android.yml
+++ b/.github/workflows/build-submit-android.yml
@@ -238,7 +238,7 @@ jobs:
       - name: 📎 Attach APK to GitHub Release
         id: attach
         if: ${{ steps.release-check.outputs.exists == 'true' }}
-        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
         with:
           tag_name: ${{ github.ref_name }}
           files: Bluesky-${{ needs.build.outputs.package-version }}.apk
diff --git a/.github/workflows/claude-mention.yml b/.github/workflows/claude-mention.yml
index 5d35d2fa63..25989190e9 100644
--- a/.github/workflows/claude-mention.yml
+++ b/.github/workflows/claude-mention.yml
@@ -65,7 +65,7 @@ jobs:
           aws-region: us-east-2
 
       - name: Claude
-        uses: anthropics/claude-code-action@9dd8b95a392eb34b6f5fb56cf5a64cb735912d4b # v1.0.150
+        uses: anthropics/claude-code-action@30544b674398ee15c84819bd87caf8a87e8c7b55 # v1.0.154
         with:
           use_bedrock: 'true'
           additional_permissions: |
diff --git a/.github/workflows/claude-review.yml b/.github/workflows/claude-review.yml
index 14d11f17e8..bb6d840c42 100644
--- a/.github/workflows/claude-review.yml
+++ b/.github/workflows/claude-review.yml
@@ -51,7 +51,7 @@ jobs:
           aws-region: us-east-2
 
       - name: Claude review
-        uses: anthropics/claude-code-action@9dd8b95a392eb34b6f5fb56cf5a64cb735912d4b # v1.0.150
+        uses: anthropics/claude-code-action@30544b674398ee15c84819bd87caf8a87e8c7b55 # v1.0.154
         with:
           use_bedrock: 'true'
           additional_permissions: |
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 56d06bbd85..052ba66500 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -26,7 +26,7 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
         with:
           # Annotate the PR directly instead of uploading SARIF to the
           # security tab, and fail the check on any finding