diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 0299e2936..a9ae46c55 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -10,10 +10,10 @@ jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
         with:
           python-version: '3.10'
-      - uses: pre-commit/action@v2.0.0
+      - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd # v3.0.1
         env:
           SKIP: yamlfmt
diff --git a/.github/workflows/semgrep-rule-lints.yaml b/.github/workflows/semgrep-rule-lints.yaml
index a7214a1f3..df6f14d6b 100644
--- a/.github/workflows/semgrep-rule-lints.yaml
+++ b/.github/workflows/semgrep-rule-lints.yaml
@@ -8,13 +8,13 @@ on:
 
 jobs:
   semgrep:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     name: semgrep-rule-lints
     steps:
       - uses: actions/checkout@v2
       - uses: actions/setup-python@v2
         with:
-          python-version: 3.9.2
+          python-version: 3.9.23
       - name: install semgrep
         run: pip3 install semgrep
       - name: lints for semgrep rules
diff --git a/.github/workflows/semgrep-rules-test.yml b/.github/workflows/semgrep-rules-test.yml
index 757d81b80..f1f80f157 100644
--- a/.github/workflows/semgrep-rules-test.yml
+++ b/.github/workflows/semgrep-rules-test.yml
@@ -12,12 +12,12 @@ on:
 jobs:
   test-latest:
     name: rules-test-latest
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v2
       - uses: actions/setup-python@v2
         with:
-          python-version: 3.9.2
+          python-version: 3.9.23
       - name: install semgrep via pip
         run: pip3 install semgrep
       - name: validate rules
diff --git a/.github/workflows/validate-r2c-registry-metadata.yaml b/.github/workflows/validate-r2c-registry-metadata.yaml
index bccd134b1..281bfda28 100644
--- a/.github/workflows/validate-r2c-registry-metadata.yaml
+++ b/.github/workflows/validate-r2c-registry-metadata.yaml
@@ -16,7 +16,7 @@ jobs:
   validate-metadata:
     if: github.repository == 'amplify-security/opengrep-rules'
     name: Validate r2c registry metadata
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@v2
         with:
@@ -35,7 +35,7 @@ jobs:
         run: echo $CHANGED_FILES
       - uses: actions/setup-python@v2
         with:
-          python-version: 3.9.2
+          python-version: 3.9.23
       - name: install deps
         run: pip install jsonschema pyyaml
       - name: validate metadata
diff --git a/configs/amplify.list b/configs/amplify.list
new file mode 100644
index 000000000..9220ea2b6
--- /dev/null
+++ b/configs/amplify.list
@@ -0,0 +1 @@
+yaml/github-actions/security/third-party-action-not-pinned-to-commit-sha.yml:third-party-action-not-pinned-to-commit-sha