diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index c6ad10c..c2b7396 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -25,10 +25,10 @@ jobs:
         language: [javascript-typescript]
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.35.3
+      - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.35.3
         with:
           languages: ${{ matrix.language }}
           queries: security-and-quality
-      - uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.35.3
+      - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.35.3
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/truecopy-gate.yml b/.github/workflows/truecopy-gate.yml
index e434c8e..5aebb0a 100644
--- a/.github/workflows/truecopy-gate.yml
+++ b/.github/workflows/truecopy-gate.yml
@@ -28,4 +28,4 @@ jobs:
       - name: manifest matches the live tool surface
         run: node support/dump-tools.mjs --check
       - name: truecopy verify
-        uses: askalf/truecopy-action@f9492aba42bacb64b0af013a6dbc5c833121fe8e # v1.0.3
+        uses: askalf/truecopy-action@3983d2503f60cbca040f20f0be82347ce6f41f5e # v1.1.0