diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 6283a74..966fc54 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -31,10 +31,10 @@ jobs:
           distribution: temurin
           java-version: 21
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4
+        uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
         with:
           languages: java
       - name: Build with Maven Wrapper
         run: bash ./mvnw -q -DskipTests package
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4
+        uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f78a541..285cad6 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -61,11 +61,11 @@ jobs:
           echo "jar=$jar" >> "$GITHUB_OUTPUT"
           echo "sbom_json=$sbom_json" >> "$GITHUB_OUTPUT"
       - name: Generate provenance attestations
-        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-checksums: target/checksums.txt
       - name: Generate SBOM attestation
-        uses: actions/attest@508db95dd578ae2727ebd6217d5ba78e4fbda05d # v4.2.1
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-path: ${{ steps.artifacts.outputs.jar }}
           sbom-path: ${{ steps.artifacts.outputs.sbom_json }}