diff --git a/codeql/action.yml b/codeql/action.yml
index dd0ef20..6f4b0b0 100644
--- a/codeql/action.yml
+++ b/codeql/action.yml
@@ -38,7 +38,7 @@ runs:
         FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2
+      uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
       env:
         FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
       with:
@@ -61,12 +61,12 @@ runs:
 
     - if: ${{ inputs.build-mode == 'autobuild' }}
       name: Autobuild
-      uses: github/codeql-action/autobuild@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2
+      uses: github/codeql-action/autobuild@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
       env:
         FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@e0647621c2984b5ed2f768cb892365bf2a616ad1 # v4.37.2
+      uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3
       env:
         FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
       with:
diff --git a/ruby/build/action.yml b/ruby/build/action.yml
index a124f26..35a2d34 100644
--- a/ruby/build/action.yml
+++ b/ruby/build/action.yml
@@ -42,7 +42,7 @@ runs:
         submodules: true
 
     - name: Setup Ruby
-      uses: ruby/setup-ruby@a30dfa457ad68707b8b910ac3a244714b61c0626 # v1.320.0
+      uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
       with:
         ruby-version: ${{ inputs.ruby_version }}
         rubygems: ${{ inputs.rubygems_version }}
diff --git a/ruby/publish/action.yml b/ruby/publish/action.yml
index a973127..41b65cf 100644
--- a/ruby/publish/action.yml
+++ b/ruby/publish/action.yml
@@ -65,7 +65,7 @@ runs:
         submodules: true
 
     - name: Setup Ruby
-      uses: ruby/setup-ruby@a30dfa457ad68707b8b910ac3a244714b61c0626 # v1.320.0
+      uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
       with:
         ruby-version: ${{ inputs.ruby_version }}
         rubygems: ${{ inputs.rubygems_version }}
diff --git a/setup/action.yml b/setup/action.yml
index 3a4ad26..53f016d 100644
--- a/setup/action.yml
+++ b/setup/action.yml
@@ -25,7 +25,7 @@ runs:
   steps:
   # Docker login must be done before input role login so we remain logged in for S3 upload.
   - name: configure aws credentials for ECR
-    uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
+    uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
     with:
       role-to-assume: ${{ inputs.ecr_role_arn }}
       role-session-name: release-session
@@ -39,7 +39,7 @@ runs:
     env:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: "true"
   - name: configure aws credentials
-    uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6.2.2
+    uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
     with:
       role-to-assume: ${{ inputs.aws_role_arn }}
       role-session-name: release-session