diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9b63341..11f4991 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -79,7 +79,7 @@ jobs:
       - name: Post coverage comment on PR
         if: github.event_name == 'pull_request'
         continue-on-error: true
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const fs = require('fs');
@@ -144,7 +144,7 @@ jobs:
           GOOS=linux GOARCH=arm64 go build -ldflags "$LDFLAGS" -o switchboard-a-linux-arm64 ./cmd/switchboard
 
       - name: Upload binaries
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: binaries
           path: switchboard-a-*
@@ -266,7 +266,7 @@ jobs:
           done
 
       - name: Upload signed binaries and installers
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: signed-binaries
           path: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 405709c..28cee88 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -78,7 +78,7 @@ jobs:
           GOOS=linux GOARCH=arm64 go build -ldflags "$LDFLAGS" -o switchboard-linux-arm64 ./cmd/switchboard
 
       - name: Upload binaries
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: binaries
           path: switchboard-*
@@ -200,7 +200,7 @@ jobs:
           done
 
       - name: Upload signed binaries and installers
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: signed-binaries
           path: |