diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 78a4ce8d..736df27e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -30,7 +30,7 @@ jobs:
         uses: "actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8" # v5
 
       - name: "Install PHP"
-        uses: "shivammathur/setup-php@0f7f1d08e3e32076e51cae65eb0b0c871405b16e" # v2
+        uses: "shivammathur/setup-php@20529878ed81ef8e78ddf08b480401e6101a850f" # v2
         with:
           coverage: "pcov"
           php-version: "${{ matrix.php-version }}"
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index cc3b3bc5..e8eb6c05 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-24.04
     name: Release Automation
     steps:
-      - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2
+      - uses: actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b # v2
         id: generate-token
         with:
           app-id: ${{ secrets.LENDABOT_APP_ID }}