diff --git a/.github/workflows/doctum.yml b/.github/workflows/doctum.yml
index 296dc1ea7..7228801ec 100644
--- a/.github/workflows/doctum.yml
+++ b/.github/workflows/doctum.yml
@@ -61,7 +61,7 @@ jobs:
           pnpm --version
 
       - name: Deploy
-        uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4.0.0
+        uses: cloudflare/wrangler-action@953926a2e2182532811c01a25e53647d93bf07c0 # v4.1.3
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
diff --git a/.github/workflows/submission-maintenance.yml b/.github/workflows/submission-maintenance.yml
index 3821a2855..4b848ea5a 100644
--- a/.github/workflows/submission-maintenance.yml
+++ b/.github/workflows/submission-maintenance.yml
@@ -59,7 +59,7 @@ jobs:
           ref: ${{ github.event.repository.default_branch }}
           persist-credentials: false
           sparse-checkout: .github/scripts
-      - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           CLEANUP_DRY_RUN: ${{ github.event_name == 'workflow_dispatch' && inputs.dry_run }}
         with: