diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 68b0eb8..d79888a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -158,7 +158,7 @@ jobs:
         with:
           node-version: "22"
       - uses: astral-sh/setup-uv@v7
-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "21"
@@ -356,7 +356,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "17"
@@ -377,7 +377,7 @@ jobs:
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "17"
@@ -518,7 +518,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "17"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index ac4ac3e..e1485e7 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v7
       - name: Setup Java (Android)
         if: matrix.language == 'java-kotlin'
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "17"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 541d42e..0451504 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -96,7 +96,7 @@ jobs:
         run: bash scripts/pre-release-gate.sh
 
       - name: Generate root SBOM
-        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.20.6
+        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.20.6
         with:
           path: .
           format: cyclonedx-json
@@ -104,7 +104,7 @@ jobs:
 
       - name: Generate web stack SBOM slice
         if: hashFiles('examples/web/package.json') != ''
-        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.20.6
+        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.20.6
         with:
           path: examples/web
           format: cyclonedx-json
@@ -112,7 +112,7 @@ jobs:
 
       - name: Generate python stack SBOM slice
         if: hashFiles('examples/python/pyproject.toml') != ''
-        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.20.6
+        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.20.6
         with:
           path: examples/python
           format: cyclonedx-json
@@ -120,7 +120,7 @@ jobs:
 
       - name: Generate node stack SBOM slice
         if: hashFiles('examples/node/package.json') != ''
-        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.20.6
+        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.20.6
         with:
           path: examples/node
           format: cyclonedx-json
@@ -128,7 +128,7 @@ jobs:
 
       - name: Generate android stack SBOM slice
         if: hashFiles('examples/android/app/build.gradle.kts') != ''
-        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.20.6
+        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.20.6
         with:
           path: examples/android
           format: cyclonedx-json
@@ -136,7 +136,7 @@ jobs:
 
       - name: Generate rust stack SBOM slice
         if: hashFiles('examples/rust/Cargo.lock') != ''
-        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.20.6
+        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.20.6
         with:
           path: examples/rust
           format: cyclonedx-json
@@ -144,7 +144,7 @@ jobs:
 
       - name: Generate go stack SBOM slice
         if: hashFiles('examples/go/go.sum') != ''
-        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.20.6
+        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.20.6
         with:
           path: examples/go
           format: cyclonedx-json
@@ -200,7 +200,7 @@ jobs:
         with:
           ref: ${{ inputs.tag || github.event.release.tag_name || github.ref }}
 
-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@v6
         if: steps.sign.outputs.present == 'true'
         with:
           distribution: temurin
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 90448b2..215c27b 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -19,7 +19,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           persist-credentials: false
-      - uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
+      - uses: ossf/scorecard-action@fa7117db83c52d787ae5a89f350999701505d78e # v2.5.0
         with:
           results_file: results.sarif
           results_format: sarif
diff --git a/.github/workflows/weekly-health-check.yml b/.github/workflows/weekly-health-check.yml
index d1c689b..6abf2c9 100644
--- a/.github/workflows/weekly-health-check.yml
+++ b/.github/workflows/weekly-health-check.yml
@@ -238,7 +238,7 @@ jobs:
     timeout-minutes: 45
     steps:
       - uses: actions/checkout@v7
-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@v6
         with:
           distribution: temurin
           java-version: "17"