diff --git a/.github/workflows/build-buildkit.yaml b/.github/workflows/build-buildkit.yaml
index 3438e665..8cda7e67 100644
--- a/.github/workflows/build-buildkit.yaml
+++ b/.github/workflows/build-buildkit.yaml
@@ -58,7 +58,7 @@ jobs:
           VOLUME /home/oc_user/.local/share/buildkit
           EOF
       # Build and push the image
-      - uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
+      - uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
         with:
           context: .
           push: true
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 2fee2b8b..a9a7b36d 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -72,7 +72,7 @@ jobs:
       - name: Set arch
         run: echo "ARCH=$(uname -m | sed -e 's/arm64/aarch64/;s/amd64/x86_64/')" >> $GITHUB_ENV
       - id: cache-check
-        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae
         with:
           path: apps/microshift-vm/dist/${{ env.ARCH }}
           key: microshift-vm-dist-v1-${{ runner.os }}-${{ env.ARCH }}-${{ hashFiles('apps/microshift-vm/**') }}
diff --git a/.github/workflows/claude.yaml b/.github/workflows/claude.yaml
index 00d60653..c259c626 100644
--- a/.github/workflows/claude.yaml
+++ b/.github/workflows/claude.yaml
@@ -27,7 +27,7 @@ jobs:
       actions: read
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: anthropics/claude-code-action@657fb7c9c986158a19624b357bcbc8c6deb83598 # v1
+      - uses: anthropics/claude-code-action@c3d45e8e941e1b2ad7b278c57482d9c5bf1f35b3 # v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           additional_permissions: |
diff --git a/.github/workflows/docs-deploy.yml b/.github/workflows/docs-deploy.yml
index bca436f7..86bc522b 100644
--- a/.github/workflows/docs-deploy.yml
+++ b/.github/workflows/docs-deploy.yml
@@ -36,7 +36,7 @@ jobs:
       - run: mise run docs-site:build
         env:
           BASE_PATH: /adk
-      - uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
+      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: apps/docs-site/out
 
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index d048bafb..a98f0d30 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -32,7 +32,7 @@ jobs:
           echo "version=${GITHUB_REF#refs/tags/v}" >> $GITHUB_OUTPUT
           echo "latestTag=$([[ ${GITHUB_REF#refs/tags/v} =~ [a-zA-Z] ]] && echo prerelease || echo latest)" >> $GITHUB_OUTPUT
       - run: mise run microshift-vm:build --arch ${{ matrix.arch }}
-      - uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2
+      - uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v2
         with:
           prerelease: ${{ steps.version.outputs.latestTag == 'prerelease' }}
           files: |
@@ -74,7 +74,7 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - run: mise run 'adk-server:build:*'
-      - uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
+      - uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
         with:
           context: ./apps/adk-server
           push: true
@@ -87,7 +87,7 @@ jobs:
           cache-to: type=registry,ref=ghcr.io/${{ github.repository }}/adk-server:cache,mode=max
 
       - run: mise run 'adk-ui:build:*'
-      - uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
+      - uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
         with:
           context: .
           file: ./apps/adk-ui/Dockerfile
@@ -100,7 +100,7 @@ jobs:
           cache-from: type=registry,ref=ghcr.io/${{ github.repository }}/adk-ui:cache
           cache-to: type=registry,ref=ghcr.io/${{ github.repository }}/adk-ui:cache,mode=max
 
-      - uses: docker/build-push-action@d08e5c354a6adb9ed34480a06d141179aa583294 # v7.0.0
+      - uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
         with:
           context: ./
           file: agents/adk-support-agent/Dockerfile
diff --git a/.github/workflows/scorecard.yaml b/.github/workflows/scorecard.yaml
index 21e04b68..0811f695 100644
--- a/.github/workflows/scorecard.yaml
+++ b/.github/workflows/scorecard.yaml
@@ -27,12 +27,12 @@ jobs:
           results_format: sarif
           publish_results: true
 
-      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
         with:
           name: scorecard-results
           path: results.sarif
           retention-days: 30
 
-      - uses: github/codeql-action/upload-sarif@c10b8064de6f491fea524254123dbe5e09572f13  # v4
+      - uses: github/codeql-action/upload-sarif@95e58e9a2cdfd71adc6e0353d5c52f41a045d225  # v4
         with:
           sarif_file: results.sarif