diff --git a/.github/workflows/cd-prod_deploy.yml b/.github/workflows/cd-prod_deploy.yml
index f2329e2b..81e9f2d1 100644
--- a/.github/workflows/cd-prod_deploy.yml
+++ b/.github/workflows/cd-prod_deploy.yml
@@ -27,7 +27,7 @@ jobs:
           java-version: "21"
 
       - name: Gradle 설정
-        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6
+        uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6
 
       - name: Jib로 Docker 이미지 빌드 및 푸시
         run: ./gradlew jib --build-cache --parallel
diff --git a/.github/workflows/ci-auto-version-bump.yml b/.github/workflows/ci-auto-version-bump.yml
index 4aecbf55..2c427942 100644
--- a/.github/workflows/ci-auto-version-bump.yml
+++ b/.github/workflows/ci-auto-version-bump.yml
@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: 토큰 발급
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3
         id: app-token
         with:
           app-id: ${{ vars.VERSION_BUMPER_APPID }}
diff --git a/.github/workflows/ci-check-code-convention.yml b/.github/workflows/ci-check-code-convention.yml
index 1655cf19..ba330dca 100644
--- a/.github/workflows/ci-check-code-convention.yml
+++ b/.github/workflows/ci-check-code-convention.yml
@@ -22,7 +22,7 @@ jobs:
           java-version: "21"
 
       - name: Gradle 설정
-        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6
+        uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6
 
       - name: 포맷 검증 & 빌드 & 테스트
         run: ./gradlew spotlessCheck build --build-cache --parallel
diff --git a/.github/workflows/ci-pii-coverage.yml b/.github/workflows/ci-pii-coverage.yml
index 599ceee5..355528da 100644
--- a/.github/workflows/ci-pii-coverage.yml
+++ b/.github/workflows/ci-pii-coverage.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     services:
       mysql:
-        image: mysql:8.4@sha256:3466ba4a4828aa8d46fb7c3bc16b67b781c98413cf4ea0fac6feaa6e881faa26
+        image: mysql:8.4@sha256:24989179f58856db763f418010c1169fecc944e3ec1ea7e921572d83eb070f70
         env:
           MYSQL_ROOT_PASSWORD: password
           MYSQL_DATABASE: qaskerdb
diff --git a/.github/workflows/ci-update-api-docs.yml b/.github/workflows/ci-update-api-docs.yml
index 283de416..0dccbdf7 100644
--- a/.github/workflows/ci-update-api-docs.yml
+++ b/.github/workflows/ci-update-api-docs.yml
@@ -43,7 +43,7 @@ jobs:
           java-version: "25"
 
       - name: Gradle 설정
-        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6
+        uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6
 
       - name: 애플리케이션 빌드
         run: ./gradlew :app:bootJar --build-cache --parallel -x test
diff --git a/.github/workflows/renovate-impact-analysis.yml b/.github/workflows/renovate-impact-analysis.yml
index 2231fe98..62eb7fb4 100644
--- a/.github/workflows/renovate-impact-analysis.yml
+++ b/.github/workflows/renovate-impact-analysis.yml
@@ -35,7 +35,7 @@ jobs:
           fetch-depth: 0       # base와의 diff 분석을 위해 전체 히스토리 필요
 
       - name: Run Claude impact analysis
-        uses: anthropics/claude-code-action@19dda84776b3518d98b8798e591daee763049ed3 # v1
+        uses: anthropics/claude-code-action@34968b5981d5d170904281aa3df6f3c0d4a28855 # v1
         with:
           # Max 구독으로 인증 (API 키 대신 OAuth 토큰 사용 → 별도 청구 없음)
           # 토큰 발급: 로컬에서 `claude setup-token` 실행 후 출력 토큰을 Secrets에 등록