diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index a8c263e..c7926ce 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Checkout Repository'
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: 'Check Config'
         id: check_config
diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index b9860f9..88adecc 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -11,10 +11,10 @@ jobs:
       latest_tag_name: ${{ steps.trufflehog_release.outputs.latest_tag_name }}
     steps:
       - name: Checkout Code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Cosign
         # v4 of the action install v3 of the CLI. v4 of the CLI will deprecate some features so be aware.
-        uses: sigstore/cosign-installer@faadad0cce49287aee09b3a48701e75088a2c6ad # v4.0.0
+        uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
       - name: Pin Trufflehog to a known good release
         id: trufflehog_release
         shell: bash
diff --git a/.github/workflows/warden.yml b/.github/workflows/warden.yml
index 4eb03b6..7c9491a 100644
--- a/.github/workflows/warden.yml
+++ b/.github/workflows/warden.yml
@@ -32,10 +32,10 @@ jobs:
           exit 1
 
       - name: Checkout Code
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Checkout Org GitHub Repo
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: ${{ github.repository_owner }}/.github
           path: .warden-org
@@ -47,7 +47,7 @@ jobs:
           mode: analyze
           base-config-path: .warden-org/warden.toml
 
-      - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         id: app-token
         if: ${{ always() && steps.warden-analyze.outputs.findings-file != '' }}
         with:
@@ -84,7 +84,7 @@ jobs:
 
       - name: Upload findings to GCS
         continue-on-error: true
-        uses: google-github-actions/upload-cloud-storage@c0f6160ff80057923ff50e5e567695cea181ec23 # v2
+        uses: google-github-actions/upload-cloud-storage@6397bd7208e18d13ba2619ee21b9873edc94427a # v3.0.0
         if: ${{ always() && steps.rename-findings.outputs.path != '' }}
         with:
           path: ${{ steps.rename-findings.outputs.path }}