diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index ac5ae79d9..fe6107ecd 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -24,15 +24,15 @@ jobs:
     - uses: 'hmarr/debug-action@cd1afbd7852b7ad7b1b7a9a1b03efebd3b0a1820' # v3.0.0
 
     # https://github.com/zgosalvez/github-actions-ensure-sha-pinned-actions
-    - uses: 'zgosalvez/github-actions-ensure-sha-pinned-actions@fc87bb5b5a97953d987372e74478de634726b3e5' # v3.0.25
+    - uses: 'zgosalvez/github-actions-ensure-sha-pinned-actions@6124774845927d14c601359ab8138699fa5b70c3' # v4.0.1
 
     # https://github.com/actions/checkout
     - name: 'checkout'
-      uses: 'actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683' # v4.2.2
+      uses: 'actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8' # v6.0.1
 
     # https://github.com/actions/setup-java
     - name: 'Set up JDK'
-      uses: 'actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00' # v4.7.1
+      uses: 'actions/setup-java@f2beeb24e141e01a676f977032f5a29d81c9e27e' # v5.1.0
       with:
         java-version: '17'
         distribution: 'temurin'
@@ -40,11 +40,11 @@ jobs:
 
       # https://github.com/gradle/actions/tree/main/setup-gradle
     - name: 'Set up Gradle'
-      uses: 'gradle/actions/setup-gradle@8379f6a1328ee0e06e2bb424dadb7b159856a326' # v4.2.2
+      uses: 'gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2' # v4.2.2
 
       # https://github.com/gradle/actions/tree/main/dependency-submission
     - name: "Generate and submit dependency graph"
-      uses: "gradle/actions/dependency-submission@8379f6a1328ee0e06e2bb424dadb7b159856a326" # v4.2.2
+      uses: "gradle/actions/dependency-submission@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2" # v4.2.2
       with:
         cache-cleanup: "never"
         dependency-graph-report-dir: "${{ github.workspace }}/build/dependency-graph-reports"
diff --git a/.github/workflows/dependabot-auto-approve-pr.yml b/.github/workflows/dependabot-auto-approve-pr.yml
index d1ee079b7..8e24c1492 100644
--- a/.github/workflows/dependabot-auto-approve-pr.yml
+++ b/.github/workflows/dependabot-auto-approve-pr.yml
@@ -14,7 +14,7 @@ jobs:
       # https://github.com/dependabot/fetch-metadata
       - name: Dependabot metadata
         id: dependabot-metadata
-        uses: "dependabot/fetch-metadata@08eff52bf64351f401fb50d4972fa95b9f2c2d1b" # v2.4.0
+        uses: "dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a" # v2.5.0
 
       - name: Automatically approve & merge Dependabot patch PRs
         if: ${{steps.dependabot-metadata.outputs.update-type == 'version-update:semver-patch'}}