diff --git a/.github/workflows/on-tag.yaml b/.github/workflows/on-tag.yaml
index 59e7e31..7fe6674 100644
--- a/.github/workflows/on-tag.yaml
+++ b/.github/workflows/on-tag.yaml
@@ -278,7 +278,7 @@ jobs:
 
       - name: Upload SARIF to GitHub Security
         if: hashFiles('image-scan-results.sarif') != ''
-        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         with:
           sarif_file: image-scan-results.sarif
           category: 'grype-image-${{ steps.parse.outputs.image }}'
diff --git a/.github/workflows/qualify.yml b/.github/workflows/qualify.yml
index 7ac4db8..3579bbd 100644
--- a/.github/workflows/qualify.yml
+++ b/.github/workflows/qualify.yml
@@ -101,7 +101,7 @@ jobs:
           terraform_wrapper: false
 
       - name: Setup tflint
-        uses: terraform-linters/setup-tflint@6e1e0642c0289bd619021bf6b34e3c08ed1e005a # v6.3.0
+        uses: terraform-linters/setup-tflint@1cf010d3c7aef302051ccdb68c14c5dc2efa34ef # v6.3.1
         with:
           tflint_version: v${{ steps.versions.outputs.tflint }}