diff --git a/.github/workflows/codegen-compile.yml b/.github/workflows/codegen-compile.yml
index 4b2c692..3d38fba 100644
--- a/.github/workflows/codegen-compile.yml
+++ b/.github/workflows/codegen-compile.yml
@@ -35,13 +35,13 @@ jobs:
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Setup Rust toolchain
-        uses: dtolnay/rust-toolchain@67ef31d5b988238dd797d409d6f9574278e20537 # master 2026-02-13
+        uses: dtolnay/rust-toolchain@fa04a1451ff1842e2626ccb99004d0195b455a88 # master 2026-02-13
         with:
           toolchain: stable
           targets: wasm32v1-none
 
       - name: Cache Cargo registry & git
-        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: |
             ~/.cargo/registry
diff --git a/.github/workflows/prd.yaml b/.github/workflows/prd.yaml
index c5d0da5..7397cc6 100644
--- a/.github/workflows/prd.yaml
+++ b/.github/workflows/prd.yaml
@@ -56,7 +56,7 @@ jobs:
           token: ${{ steps.gh-app-token.outputs.token }}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v3.2.0
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v3.2.0
         with:
           platforms: 'arm64'
 
@@ -73,7 +73,7 @@ jobs:
         uses: aws-actions/amazon-ecr-login@d539f0932e70871a027e9d5a9d8fc38589180a64 # v2.1.6
 
       - name: Build and push multi-platform Docker image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v6.10.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v6.10.0
         with:
           context: .
           platforms: linux/arm64
@@ -136,14 +136,14 @@ jobs:
 
       - name: Update task definition with new image
         id: task-def
-        uses: aws-actions/amazon-ecs-render-task-definition@6853cfae8c3a7d978fbf68b5a55453395541dfbb #v1.8.5
+        uses: aws-actions/amazon-ecs-render-task-definition@138c24f321fdbdf7edee4a685519d253cae2cdea #v1.9.0
         with:
           task-definition: task-definition.json
           container-name: rwa-wizard-prod
           image: ${{ steps.set-image.outputs.image_uri }}
 
       - name: Deploy to ECS
-        uses: aws-actions/amazon-ecs-deploy-task-definition@a310a830f5c14e583e35d84e4e1ec7dd177c3c9c #v2.6.2
+        uses: aws-actions/amazon-ecs-deploy-task-definition@c465972ecbd160473f22e683363b422a5412a3de #v2.6.3
         with:
           cluster: ${{ env.ECS_CLUSTER }}
           service: ${{ env.ECS_SERVICE }}
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 39d3fd8..171ffc8 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -161,12 +161,12 @@ jobs:
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
 
       - name: Upload attestations SLSA
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373
         with:
           subject-path: ${{ needs.provenance.outputs.provenance-download-name }}
           subject-name: ${{ github.event.repository.name }}-${{ steps.extract_version.outputs.version }}
 
       - name: Upload attestations SBOM
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32
+        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373
         with:
           subject-path: /${{ steps.temp-dir.outputs.path }}/sbom-${{ github.event.repository.name }}-${{ steps.extract_version.outputs.version }}.spdx.json
diff --git a/.github/workflows/stg.yaml b/.github/workflows/stg.yaml
index 51c35a2..fce8bdc 100644
--- a/.github/workflows/stg.yaml
+++ b/.github/workflows/stg.yaml
@@ -53,7 +53,7 @@ jobs:
           token: ${{ steps.gh-app-token.outputs.token }}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v3.2.0
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v3.2.0
         with:
           platforms: 'arm64'
 
@@ -70,7 +70,7 @@ jobs:
         uses: aws-actions/amazon-ecr-login@d539f0932e70871a027e9d5a9d8fc38589180a64 # v2.1.6
 
       - name: Build and push multi-platform Docker image
-        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v6.10.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v6.10.0
         with:
           context: .
           platforms: linux/arm64
@@ -134,14 +134,14 @@ jobs:
 
       - name: Update task definition with new image
         id: task-def
-        uses: aws-actions/amazon-ecs-render-task-definition@6853cfae8c3a7d978fbf68b5a55453395541dfbb #v1.8.5
+        uses: aws-actions/amazon-ecs-render-task-definition@138c24f321fdbdf7edee4a685519d253cae2cdea #v1.9.0
         with:
           task-definition: task-definition.json
           container-name: rwa-wizard-stg
           image: ${{ steps.set-image.outputs.image_uri }}
 
       - name: Deploy to ECS
-        uses: aws-actions/amazon-ecs-deploy-task-definition@a310a830f5c14e583e35d84e4e1ec7dd177c3c9c #v2.6.2
+        uses: aws-actions/amazon-ecs-deploy-task-definition@c465972ecbd160473f22e683363b422a5412a3de #v2.6.3
         with:
           cluster: ${{ env.ECS_CLUSTER }}
           service: ${{ env.ECS_SERVICE }}