diff --git a/.github/workflows/ci-arm-build.yml b/.github/workflows/ci-arm-build.yml
index c5173fc410bc..c06b65bade7a 100644
--- a/.github/workflows/ci-arm-build.yml
+++ b/.github/workflows/ci-arm-build.yml
@@ -29,7 +29,7 @@ jobs:
       - uses: actions/checkout@v7.0.0
       - name: setup docker buildx
         id: buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v4.1.0
         with:
           driver: docker-container
       - name: expose github runtime for buildx
@@ -37,7 +37,7 @@ jobs:
       - name: show system environs
         run: ./ci/helpers/show_system_versions.bash
       - name: login to Dockerhub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.2.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
diff --git a/.github/workflows/ci-multi-architecture-fusing.yml b/.github/workflows/ci-multi-architecture-fusing.yml
index 3c1906ac6120..032236fc266b 100644
--- a/.github/workflows/ci-multi-architecture-fusing.yml
+++ b/.github/workflows/ci-multi-architecture-fusing.yml
@@ -27,10 +27,10 @@ jobs:
     steps:
       - uses: actions/checkout@v7.0.0
       - name: setup QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@v4.1.0
       - name: setup docker buildx
         id: buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v4.1.0
         with:
           driver: docker-container
       - name: expose github runtime for buildx
@@ -38,7 +38,7 @@ jobs:
       - name: show system environs
         run: ./ci/helpers/show_system_versions.bash
       - name: login to Dockerhub
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.2.0
         with:
           username: ${{ secrets.DOCKER_USERNAME }}
           password: ${{ secrets.DOCKER_PASSWORD }}
diff --git a/.github/workflows/ci-pact-master.yml b/.github/workflows/ci-pact-master.yml
index 1ef7d46acc20..694019300ab3 100644
--- a/.github/workflows/ci-pact-master.yml
+++ b/.github/workflows/ci-pact-master.yml
@@ -22,7 +22,7 @@ jobs:
       PACT_BROKER_PASSWORD: ${{ secrets.PACT_BROKER_PASSWORD }}
     steps:
       - name: setup python environment
-        uses: actions/setup-python@v6.2.0
+        uses: actions/setup-python@v6.3.0
         with:
           python-version: "3.13"
       - name: install uv
diff --git a/.github/workflows/ci-release.yml b/.github/workflows/ci-release.yml
index 752da39305a3..e6c37212e5e9 100644
--- a/.github/workflows/ci-release.yml
+++ b/.github/workflows/ci-release.yml
@@ -35,7 +35,7 @@ jobs:
         run: echo "BRANCH_NAME=$(git name-rev --refs="refs/remotes/origin/master" --refs="refs/remotes/origin/hotfix_v*" --refs="refs/remotes/origin/hotfix_staging_*" --name-only ${GITHUB_SHA})" >> $GITHUB_ENV
       - name: setup docker buildx
         id: buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v4.1.0
       - name: set owner variable
         run: echo "OWNER=${GITHUB_REPOSITORY%/*}" >> $GITHUB_ENV
       - name: set git tag
diff --git a/.github/workflows/ci-staging.yml b/.github/workflows/ci-staging.yml
index df9b955b09c7..26526151a2ec 100644
--- a/.github/workflows/ci-staging.yml
+++ b/.github/workflows/ci-staging.yml
@@ -35,7 +35,7 @@ jobs:
         run: echo "BRANCH_NAME=$(git name-rev --refs="refs/remotes/origin/master" --refs="refs/remotes/origin/hotfix_v*" --refs="refs/remotes/origin/hotfix_staging_*" --name-only ${GITHUB_SHA})" >> $GITHUB_ENV
       - name: setup docker buildx
         id: buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v4.1.0
       - name: set owner variable
         run: echo "OWNER=${GITHUB_REPOSITORY%/*}" >> $GITHUB_ENV
       - name: set git tag
diff --git a/.github/workflows/ci-testing-deploy.yml b/.github/workflows/ci-testing-deploy.yml
index 400afa67b882..c79e1fef4ebe 100644
--- a/.github/workflows/ci-testing-deploy.yml
+++ b/.github/workflows/ci-testing-deploy.yml
@@ -85,7 +85,7 @@ jobs:
     steps:
       - uses: actions/checkout@v7.0.0
       # For pull requests it's not necessary to checkout the code
-      - uses: dorny/paths-filter@v4
+      - uses: dorny/paths-filter@v4.0.1
         id: filter
         with:
           filters: |
diff --git a/.github/workflows/ci-testing-pull-request.yml b/.github/workflows/ci-testing-pull-request.yml
index 12fe6a2ba022..4e395582c4a9 100644
--- a/.github/workflows/ci-testing-pull-request.yml
+++ b/.github/workflows/ci-testing-pull-request.yml
@@ -34,7 +34,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: setup python environment
-        uses: actions/setup-python@v6.2.0
+        uses: actions/setup-python@v6.3.0
         with:
           python-version: "3.13"
       - name: install uv
@@ -64,7 +64,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: setup python environment
-        uses: actions/setup-python@v6.2.0
+        uses: actions/setup-python@v6.3.0
         with:
           python-version: "3.13"
       - name: checkout
@@ -92,7 +92,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: setup python environment
-        uses: actions/setup-python@v6.2.0
+        uses: actions/setup-python@v6.3.0
         with:
           python-version: "3.13"
       - name: checkout
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 93b4c8ed5557..d9da2354129a 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -29,10 +29,10 @@ jobs:
         uses: actions/checkout@v7.0.0
 
       - name: Initialize CodeQL tools for scanning
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@v4.36.2
         with:
           languages: ${{ matrix.language }}
           config-file: ./.github/codeql/codeql-config.yml
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@v4.36.2