diff --git a/.github/workflows/actions-security.yml b/.github/workflows/actions-security.yml
index 5fe17d6..cbd26bd 100644
--- a/.github/workflows/actions-security.yml
+++ b/.github/workflows/actions-security.yml
@@ -36,7 +36,7 @@ jobs:
       # It remains here while portable actionlint runs with Gitea CI, but scans
       # both workflow directories through its GitHub Actions rule set.
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
         with:
           persona: regular
           inputs: |
diff --git a/.github/workflows/rust-clippy.yml b/.github/workflows/rust-clippy.yml
index a62fa1d..8c47f15 100644
--- a/.github/workflows/rust-clippy.yml
+++ b/.github/workflows/rust-clippy.yml
@@ -60,7 +60,7 @@ jobs:
           exit 0
 
       - name: Upload Clippy SARIF
-        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4
         if: always()
         with:
           sarif_file: rust-clippy-results.sarif