diff --git a/.github/workflows/docs-gen-and-push.yaml b/.github/workflows/docs-gen-and-push.yaml
index bea32e3f549..f85c690791a 100644
--- a/.github/workflows/docs-gen-and-push.yaml
+++ b/.github/workflows/docs-gen-and-push.yaml
@@ -27,17 +27,17 @@ jobs:
     name: Generate and push
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # tag=v6.0.3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # tag=v7.0.0
 
       - run: git fetch origin gh-pages
       - run: git fetch origin '+refs/tags/v*:refs/tags/v*' --no-tags
 
-      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # tag=v6.4.0
+      - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # tag=v6.5.0
         with:
           go-version: v1.26.4
           cache: true
 
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 #tag=v6.2.0
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 #tag=v6.3.0
         with:
           python-version: "3.10"
           cache: "pip"
diff --git a/.github/workflows/gh-image-purge.yaml b/.github/workflows/gh-image-purge.yaml
index fe23a3ea1a9..34bbe8c66ec 100644
--- a/.github/workflows/gh-image-purge.yaml
+++ b/.github/workflows/gh-image-purge.yaml
@@ -7,7 +7,7 @@ jobs:
   cleanup:
     runs-on: ubuntu-latest
     steps:
-      - uses: dataaxiom/ghcr-cleanup-action@f092b48ba3b604b2a83690dc4b2bbb3392e1045f # tag=v1.2.1
+      - uses: dataaxiom/ghcr-cleanup-action@d52806a0dc70b430571a37da1fde39733ffd640f # tag=v1.2.2
         with:
           older-than: 1 month
           owner: kcp-dev
diff --git a/.github/workflows/goreleaser.yml b/.github/workflows/goreleaser.yml
index 49a6f361d00..15dbd5f4294 100644
--- a/.github/workflows/goreleaser.yml
+++ b/.github/workflows/goreleaser.yml
@@ -39,12 +39,12 @@ jobs:
           varcache: false
 
       - name: Checkout
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # tag=v6.0.3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # tag=v7.0.0
         with:
           fetch-depth: 0
 
       - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # tag=v6.4.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # tag=v6.5.0
         with:
           go-version: v1.26.4
 
@@ -56,7 +56,7 @@ jobs:
 
       - name: Run GoReleaser on tag
         if: github.event_name != 'pull_request'
-        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # tag=v7.2.2
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # tag=v7.2.3
         with:
           distribution: goreleaser
           version: "~> v2"
@@ -67,7 +67,7 @@ jobs:
 
       - name: Run GoReleaser on pull request
         if: github.event_name == 'pull_request'
-        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # tag=v7.2.2
+        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # tag=v7.2.3
         with:
           distribution: goreleaser
           version: "~> v2"