diff --git a/.github/workflows/beest-verification.yml b/.github/workflows/beest-verification.yml
index f681254d..ea4cc3b9 100644
--- a/.github/workflows/beest-verification.yml
+++ b/.github/workflows/beest-verification.yml
@@ -47,7 +47,7 @@ jobs:
     steps:
       - name: Mint GitHub App token (dispatch beest workflows)
         id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           client-id: ${{ vars.BEEST_GH_APP_CLIENT_ID }}
           private-key: ${{ secrets.BEEST_GH_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5f8abc39..f998166a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,7 +25,7 @@ jobs:
       contents: read
     steps:
       - name: Check out repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
@@ -58,7 +58,7 @@ jobs:
             builder-image: quay.io/stackstate/datadog_build_deb_arm64:main@sha256:ad9102e44c436a0a503a4275b2e15d061cf8723f754f439591b85fb2217f2593
     steps:
       - name: Check out source commit
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           fetch-depth: 0
@@ -117,7 +117,7 @@ jobs:
             '
 
       - name: Upload process-agent image inputs
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: process-agent-${{ matrix.arch }}
           path: |
@@ -146,19 +146,19 @@ jobs:
             llvm-arch: arm64
     steps:
       - name: Check out source commit
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           persist-credentials: false
 
       - name: Download process-agent image inputs
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: process-agent-${{ matrix.arch }}
           path: .
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Resolve image metadata
         id: image
@@ -170,7 +170,7 @@ jobs:
           echo "tag=${short_sha}" >> "${GITHUB_OUTPUT}"
 
       - name: Build local BCI runtime image
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           file: BCI.dockerfile
@@ -214,7 +214,7 @@ jobs:
 
       - name: Upload image scan evidence
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: process-agent-scan-${{ matrix.arch }}
           path: reports/
@@ -249,19 +249,19 @@ jobs:
             llvm-arch: arm64
     steps:
       - name: Check out source commit
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
           persist-credentials: false
 
       - name: Download process-agent image inputs
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: process-agent-${{ matrix.arch }}
           path: .
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Resolve image tag
         id: image
diff --git a/.github/workflows/update-datadog-dependency.yml b/.github/workflows/update-datadog-dependency.yml
index 6a733919..821184f8 100644
--- a/.github/workflows/update-datadog-dependency.yml
+++ b/.github/workflows/update-datadog-dependency.yml
@@ -23,7 +23,7 @@ jobs:
     steps:
       - name: Create updatecli GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           client-id: ${{ vars.UPDATECLI_GH_APP_CLIENT_ID }}
           private-key: ${{ secrets.UPDATECLI_GH_APP_PRIVATE_KEY }}
@@ -32,13 +32,13 @@ jobs:
           repositories: stackstate-process-agent
 
       - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
           persist-credentials: false
 
       - name: Setup Go
-        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5.5.0
+        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version-file: go.mod
           cache: true