diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 3fea0d9..06ca717 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -25,10 +25,10 @@ jobs:
         language: [javascript-typescript]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: github/codeql-action/init@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.35.3
+      - uses: github/codeql-action/init@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.35.3
         with:
           languages: ${{ matrix.language }}
           queries: security-and-quality
-      - uses: github/codeql-action/analyze@f205ea1c3313d32999d8d6a48b4f6530d4437b38 # v4.35.3
+      - uses: github/codeql-action/analyze@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.35.3
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/truecopy-gate.yml b/.github/workflows/truecopy-gate.yml
index a745a82..e434c8e 100644
--- a/.github/workflows/truecopy-gate.yml
+++ b/.github/workflows/truecopy-gate.yml
@@ -28,4 +28,4 @@ jobs:
       - name: manifest matches the live tool surface
         run: node support/dump-tools.mjs --check
       - name: truecopy verify
-        uses: askalf/truecopy-action@5c6fcf00edb83ff4846206392722292d45fee227 # v1.0.1
+        uses: askalf/truecopy-action@f9492aba42bacb64b0af013a6dbc5c833121fe8e # v1.0.3