diff --git a/.github/workflows/action-pin-review.yml b/.github/workflows/action-pin-review.yml
index a01b44e..524e686 100644
--- a/.github/workflows/action-pin-review.yml
+++ b/.github/workflows/action-pin-review.yml
@@ -127,7 +127,7 @@ jobs:
         id: attest
         if: steps.review.outcome == 'success'
         continue-on-error: true
-        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4
         with:
           subject-path: action-pin-review/artifact-manifest.json
 
diff --git a/.github/workflows/android-instrumentation.yml b/.github/workflows/android-instrumentation.yml
index 9191692..2fb6417 100644
--- a/.github/workflows/android-instrumentation.yml
+++ b/.github/workflows/android-instrumentation.yml
@@ -25,7 +25,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Setup Java
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
         with:
           distribution: temurin
           java-version: "21"
@@ -58,7 +58,7 @@ jobs:
           cache-dependency-path: pnpm-lock.yaml
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6
+        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 858741f..2d9cc11 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,7 +25,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Setup Java
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
         with:
           distribution: temurin
           java-version: "21"
@@ -52,7 +52,7 @@ jobs:
           cache-dependency-path: pnpm-lock.yaml
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6
+        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
diff --git a/.github/workflows/compatibility.yml b/.github/workflows/compatibility.yml
index ad613cf..8292fdf 100644
--- a/.github/workflows/compatibility.yml
+++ b/.github/workflows/compatibility.yml
@@ -74,7 +74,7 @@ jobs:
 
       - name: Setup Java
         if: matrix.platform == 'android'
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
         with:
           distribution: temurin
           java-version: "21"
@@ -104,7 +104,7 @@ jobs:
 
       - name: Setup Gradle
         if: matrix.platform == 'android'
-        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6
+        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6
 
       - name: Install repository dependencies
         run: pnpm install --frozen-lockfile
diff --git a/.github/workflows/demo-evidence.yml b/.github/workflows/demo-evidence.yml
index 9898684..cb30f2e 100644
--- a/.github/workflows/demo-evidence.yml
+++ b/.github/workflows/demo-evidence.yml
@@ -63,7 +63,7 @@ jobs:
           test "$(git rev-parse HEAD)" = "$EXPECTED_SOURCE_SHA"
 
       - name: Setup Java
-        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
         with:
           distribution: temurin
           java-version: "21"
@@ -93,7 +93,7 @@ jobs:
           cache-dependency-path: pnpm-lock.yaml
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6
+        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
diff --git a/.github/workflows/registry-validation.yml b/.github/workflows/registry-validation.yml
index 642506c..c1ae4e1 100644
--- a/.github/workflows/registry-validation.yml
+++ b/.github/workflows/registry-validation.yml
@@ -72,7 +72,7 @@ jobs:
         id: attest
         if: steps.validate.outcome == 'success'
         continue-on-error: true
-        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4
         with:
           subject-path: registry-validation/bundle-manifest.json
 
diff --git a/.github/workflows/release-evidence-policy-review.yml b/.github/workflows/release-evidence-policy-review.yml
index 5b700ea..7ed4091 100644
--- a/.github/workflows/release-evidence-policy-review.yml
+++ b/.github/workflows/release-evidence-policy-review.yml
@@ -217,7 +217,7 @@ jobs:
         id: attest
         if: steps.review.outcome == 'success'
         continue-on-error: true
-        uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4
         with:
           subject-path: release-evidence-policy-review/artifact-manifest.json