diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index e367ecc..71d72db 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -20,7 +20,7 @@ jobs:
     - uses: 'hmarr/debug-action@cd1afbd7852b7ad7b1b7a9a1b03efebd3b0a1820' # v3.0.0
 
     # https://github.com/zgosalvez/github-actions-ensure-sha-pinned-actions
-    - uses: 'zgosalvez/github-actions-ensure-sha-pinned-actions@2d6823da4039243036c86d76f503c84e2ded2517' # v3.0.24
+    - uses: 'zgosalvez/github-actions-ensure-sha-pinned-actions@fc87bb5b5a97953d987372e74478de634726b3e5' # v3.0.25
 
     # https://github.com/actions/checkout
     - name: 'checkout'
@@ -36,7 +36,7 @@ jobs:
 
     # https://github.com/gradle/actions/tree/main/setup-gradle
     - name: 'Set up Gradle'
-      uses: 'gradle/actions/setup-gradle@06832c7b30a0129d7fb559bcc6e43d26f6374244' # v4
+      uses: 'gradle/actions/setup-gradle@8379f6a1328ee0e06e2bb424dadb7b159856a326' # v4
       with:
         gradle-version: 'wrapper'
         gradle-home-cache-includes: |-
@@ -48,7 +48,7 @@ jobs:
 
     # https://github.com/gradle/actions/tree/main/dependency-submission
     - name: "Generate and submit dependency graph"
-      uses: "gradle/actions/dependency-submission@06832c7b30a0129d7fb559bcc6e43d26f6374244" # v4
+      uses: "gradle/actions/dependency-submission@8379f6a1328ee0e06e2bb424dadb7b159856a326" # v4
       env:
         DEPENDENCY_GRAPH_EXCLUDE_PROJECTS: "^:(build-logic|buildSrc|.*[Tt]test.*)"
         DEPENDENCY_GRAPH_EXCLUDE_CONFIGURATIONS: ".*[Tt]est.*Classpath"
diff --git a/.github/workflows/dependabot-auto-approve-pr.yml b/.github/workflows/dependabot-auto-approve-pr.yml
index ebe152c..d1ee079 100644
--- a/.github/workflows/dependabot-auto-approve-pr.yml
+++ b/.github/workflows/dependabot-auto-approve-pr.yml
@@ -14,7 +14,7 @@ jobs:
       # https://github.com/dependabot/fetch-metadata
       - name: Dependabot metadata
         id: dependabot-metadata
-        uses: "dependabot/fetch-metadata@d7267f607e9d3fb96fc2fbe83e0af444713e90b7" # v2.3.0
+        uses: "dependabot/fetch-metadata@08eff52bf64351f401fb50d4972fa95b9f2c2d1b" # v2.4.0
 
       - name: Automatically approve & merge Dependabot patch PRs
         if: ${{steps.dependabot-metadata.outputs.update-type == 'version-update:semver-patch'}}