diff --git a/.github/workflows/callable-labeler.yaml b/.github/workflows/callable-labeler.yaml
index 562eefa..c831e33 100644
--- a/.github/workflows/callable-labeler.yaml
+++ b/.github/workflows/callable-labeler.yaml
@@ -130,7 +130,7 @@ jobs:
                     - '**/*_spec.rb'
                     - '**/*_test.rb'
           EOF
-      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213  # v6
+      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d  # v6
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           configuration-path: ${{ runner.temp }}/labeler.yml
diff --git a/.github/workflows/cd-cdk.yaml b/.github/workflows/cd-cdk.yaml
index 055c6c3..a25e3ed 100644
--- a/.github/workflows/cd-cdk.yaml
+++ b/.github/workflows/cd-cdk.yaml
@@ -90,7 +90,7 @@ jobs:
             pip install -r "$req"
           done
 
-      - uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6
+      - uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6
         with:
           role-to-assume: ${{ secrets.deploy-role-arn }}
           aws-region: ${{ inputs.region }}
diff --git a/.github/workflows/cd-mobile-ios.yaml b/.github/workflows/cd-mobile-ios.yaml
index 488e77d..e601c58 100644
--- a/.github/workflows/cd-mobile-ios.yaml
+++ b/.github/workflows/cd-mobile-ios.yaml
@@ -62,7 +62,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
-      - uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6
+      - uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6
         with:
           role-to-assume: ${{ secrets.deploy-role-arn }}
           aws-region: ${{ inputs.region }}
diff --git a/.github/workflows/cd-sam.yaml b/.github/workflows/cd-sam.yaml
index d176ea4..84dbdb2 100644
--- a/.github/workflows/cd-sam.yaml
+++ b/.github/workflows/cd-sam.yaml
@@ -48,7 +48,7 @@ jobs:
 
       - uses: aws-actions/setup-sam@89ddb14d60e682855e3fea4be85b3c56485de310 # v3
 
-      - uses: aws-actions/configure-aws-credentials@254c19bd240aabef8777f48595e9d2d7b972184b # v6
+      - uses: aws-actions/configure-aws-credentials@517a711dbcd0e402f90c77e7e2f81e849156e31d # v6
         with:
           role-to-assume: ${{ secrets.deploy-role-arn }}
           aws-region: ${{ inputs.region }}
diff --git a/.github/workflows/compliance-audit.yaml b/.github/workflows/compliance-audit.yaml
index 5d5a7b8..b5b0a69 100644
--- a/.github/workflows/compliance-audit.yaml
+++ b/.github/workflows/compliance-audit.yaml
@@ -76,7 +76,7 @@ jobs:
 
       - name: Run compliance audit
         id: audit
-        uses: anthropics/claude-code-action@558b1d6cab4085c7753fe402c10bef0fbb92ac7a # v1
+        uses: anthropics/claude-code-action@e90deca47693f9457b72f2b53c17d7c445a87342 # v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           prompt: |