diff --git a/.github/scripts/tests/test_opentelemetry_conformance_workflow.py b/.github/scripts/tests/test_opentelemetry_conformance_workflow.py
index b770f744..7b1f4535 100644
--- a/.github/scripts/tests/test_opentelemetry_conformance_workflow.py
+++ b/.github/scripts/tests/test_opentelemetry_conformance_workflow.py
@@ -4,7 +4,6 @@
 WORKFLOW_PATH = (
     Path(__file__).parents[2] / "workflows" / "opentelemetry-conformance-tests.yml"
 )
-ORCHESTRATOR_REVISION = "91740c98b496409fa9f1bb8e8e6c329ca8b0185f"
 EXAMPLES_DIR = (
     ".build/durable-sdk/packages/aws-durable-execution-sdk-python-conformance-tests-otel"
 )
@@ -17,7 +16,7 @@ def test_opentelemetry_conformance_caller_uses_current_workflow_contract() -> No
 
     orchestrator = (
         "uses: aws/aws-durable-execution-conformance-tests/.github/workflows/"
-        f"opentelemetry-orchestrator.yml@{ORCHESTRATOR_REVISION}"
+        "opentelemetry-orchestrator.yml@"
     )
     assert orchestrator in workflow
     assert "python-opentelemetry.yml@" not in workflow
diff --git a/.github/workflows/ecr-release.yml b/.github/workflows/ecr-release.yml
index e11aad10..bc4ebe73 100644
--- a/.github/workflows/ecr-release.yml
+++ b/.github/workflows/ecr-release.yml
@@ -69,7 +69,7 @@ jobs:
 
       - name: Login to Amazon ECR
         id: login-ecr-public
-        uses: aws-actions/amazon-ecr-login@d539f0932e70871a027e9d5a9d8fc38589180a64 # v2.1.6
+        uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2.1.7
         with:
           registry-type: public
 
@@ -99,7 +99,7 @@ jobs:
           aws-region: ${{ env.aws_region }}
 
       - name: Login to Amazon ECR
-        uses: aws-actions/amazon-ecr-login@d539f0932e70871a027e9d5a9d8fc38589180a64 # v2.1.6
+        uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2.1.7
         with:
           registry-type: public
 
diff --git a/.github/workflows/opentelemetry-conformance-tests.yml b/.github/workflows/opentelemetry-conformance-tests.yml
index 6746b1c8..319d4698 100644
--- a/.github/workflows/opentelemetry-conformance-tests.yml
+++ b/.github/workflows/opentelemetry-conformance-tests.yml
@@ -58,7 +58,7 @@ jobs:
       actions: write
       contents: read
       id-token: write
-    uses: aws/aws-durable-execution-conformance-tests/.github/workflows/opentelemetry-orchestrator.yml@91740c98b496409fa9f1bb8e8e6c329ca8b0185f
+    uses: aws/aws-durable-execution-conformance-tests/.github/workflows/opentelemetry-orchestrator.yml@a68f527bd42971544a2897123ef5b46b071e7001
     with:
       language: python
       resource_prefix: p
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 801e1e83..7016cd26 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -75,6 +75,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           sarif_file: results.sarif