diff --git a/.github/workflows/build-greenhousectl.yaml b/.github/workflows/build-greenhousectl.yaml
index f6e8f457b..4d42bda69 100644
--- a/.github/workflows/build-greenhousectl.yaml
+++ b/.github/workflows/build-greenhousectl.yaml
@@ -15,7 +15,7 @@ jobs:
   build:
     runs-on: [ ubuntu-latest ]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -29,7 +29,7 @@ jobs:
       - name: cleanup autogenerated files
         run: git checkout .
       - name: release
-        uses: goreleaser/goreleaser-action@1a80836c5c9d9e5755a25cb59ec6f45a3b5f41a8 # v7.2.1
+        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
         with:
           distribution: goreleaser
           version: ${{ vars.GITHUB_SHA }}
diff --git a/.github/workflows/check-changes-crd-api.yaml b/.github/workflows/check-changes-crd-api.yaml
index 4f3d97bcd..121c0dc9c 100644
--- a/.github/workflows/check-changes-crd-api.yaml
+++ b/.github/workflows/check-changes-crd-api.yaml
@@ -31,7 +31,7 @@ jobs:
           permission-contents: write
 
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name }}
           ref: ${{ github.event.pull_request.head.ref }}
diff --git a/.github/workflows/ci-e2e-run.yaml b/.github/workflows/ci-e2e-run.yaml
index 8ad86751d..c24a40370 100644
--- a/.github/workflows/ci-e2e-run.yaml
+++ b/.github/workflows/ci-e2e-run.yaml
@@ -87,7 +87,7 @@ jobs:
 
       - name: Checkout PR head (for suite discovery)
         if: steps.cmd.outputs.discover == 'true'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           ref: ${{ steps.pr.outputs.sha }}
 
diff --git a/.github/workflows/ci-e2e-test-nightly.yaml b/.github/workflows/ci-e2e-test-nightly.yaml
index 2bd0ee1ee..60de611ef 100644
--- a/.github/workflows/ci-e2e-test-nightly.yaml
+++ b/.github/workflows/ci-e2e-test-nightly.yaml
@@ -12,7 +12,7 @@ jobs:
     name: "Prepare E2E Scenarios"
     steps:
       - name: "Checkout"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       # find all e2e scenarios in the e2e directory and generate an array of scenario names
       - name: "E2E Detection"
diff --git a/.github/workflows/ci-e2e-test.yaml b/.github/workflows/ci-e2e-test.yaml
index 339065398..f65eb4b3c 100644
--- a/.github/workflows/ci-e2e-test.yaml
+++ b/.github/workflows/ci-e2e-test.yaml
@@ -20,7 +20,7 @@ jobs:
     name: "Prepare E2E Scenarios"
     steps:
       - name: "Checkout"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       # find all e2e scenarios in the e2e directory and generate an array of scenario names
       - name: "E2E Detection"
@@ -76,7 +76,7 @@ jobs:
   lint:
     runs-on: [ ubuntu-latest ]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/ci-release.yaml b/.github/workflows/ci-release.yaml
index 008104584..612d8457e 100644
--- a/.github/workflows/ci-release.yaml
+++ b/.github/workflows/ci-release.yaml
@@ -13,7 +13,7 @@ jobs:
         discussions: write
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -23,7 +23,7 @@ jobs:
           go-version-file: 'go.mod'
           token: ${{ secrets.GITHUB_TOKEN }}
       - name: release
-        uses: goreleaser/goreleaser-action@1a80836c5c9d9e5755a25cb59ec6f45a3b5f41a8 # v7.2.1
+        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7.2.2
         with:
           distribution: goreleaser
           version: ${{ vars.GITHUB_SHA }}
@@ -31,7 +31,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Build Changelog
-        uses: mikepenz/release-changelog-builder-action@bcae7115752d4ed746ff92feb666574428a79415 # v6.2.1
+        uses: mikepenz/release-changelog-builder-action@348e88fab4c37338b1e803ceb2d4a7a5db6c0833 # v6.2.2
         with:
           configuration: .github/changelog-config.json
           ignorePreReleases: true
diff --git a/.github/workflows/deploy-github-pages.yaml b/.github/workflows/deploy-github-pages.yaml
index 49b05722d..ec04b112b 100644
--- a/.github/workflows/deploy-github-pages.yaml
+++ b/.github/workflows/deploy-github-pages.yaml
@@ -43,7 +43,7 @@ jobs:
           extended: true
 
       - name: Checkout greenhouse repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           repository: ${{ github.repository }}
           path: greenhouse
@@ -51,7 +51,7 @@ jobs:
           fetch-depth: 0
 
       - name: Checkout greenhouse-extensions repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           repository: ${{ github.repository_owner}}/greenhouse-extensions
           ref: ${{ github.event.client_payload.sha }}
diff --git a/.github/workflows/docker-build.yaml b/.github/workflows/docker-build.yaml
index c3789d846..8e5c0ea2c 100644
--- a/.github/workflows/docker-build.yaml
+++ b/.github/workflows/docker-build.yaml
@@ -30,7 +30,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       # Install the cosign tool except on PR
       # https://github.com/sigstore/cosign-installer
@@ -133,7 +133,7 @@ jobs:
           severity: "CRITICAL,HIGH,MEDIUM"
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+        uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
         if: always()
         with:
           sarif_file: trivy-results.sarif
diff --git a/.github/workflows/helm-lint.yaml b/.github/workflows/helm-lint.yaml
index b5f2f0bf8..68bdf52e1 100644
--- a/.github/workflows/helm-lint.yaml
+++ b/.github/workflows/helm-lint.yaml
@@ -11,7 +11,7 @@ jobs:
   helm-lint:
     runs-on: [ ubuntu-latest ]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
           token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/helm-push.yaml b/.github/workflows/helm-push.yaml
index f2bbf14b1..5e5c5cfa9 100644
--- a/.github/workflows/helm-push.yaml
+++ b/.github/workflows/helm-push.yaml
@@ -27,7 +27,7 @@ jobs:
             chartName: greenhouse-ui
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
             fetch-depth: 0
             token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/kustomize-lint.yaml b/.github/workflows/kustomize-lint.yaml
index 1a0c8f512..9b732c127 100644
--- a/.github/workflows/kustomize-lint.yaml
+++ b/.github/workflows/kustomize-lint.yaml
@@ -8,7 +8,7 @@ jobs:
   kustomize:
     runs-on: [ ubuntu-latest ]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/pr-docker-build.yaml b/.github/workflows/pr-docker-build.yaml
index 289b69334..da856d4d5 100644
--- a/.github/workflows/pr-docker-build.yaml
+++ b/.github/workflows/pr-docker-build.yaml
@@ -27,7 +27,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Set up QEMU
         uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
index 49d3e29cc..e665d0c81 100644
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@@ -13,7 +13,7 @@ jobs:
   lint:
     runs-on: [ ubuntu-latest ]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
@@ -30,7 +30,7 @@ jobs:
     env:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
@@ -45,7 +45,7 @@ jobs:
   build:
     runs-on: [ ubuntu-latest ]
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           token: ${{ secrets.GITHUB_TOKEN }}