diff --git a/.github/workflows/build-mobile.yml b/.github/workflows/build-mobile.yml
index 625232c0e..338185c88 100644
--- a/.github/workflows/build-mobile.yml
+++ b/.github/workflows/build-mobile.yml
@@ -226,7 +226,7 @@ jobs:
 
       - name: Setup Java
         if: ${{ matrix.platform == 'android' }}
-        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
           distribution: temurin
           java-version: 17
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a7f43ae3c..44dd81d4e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -42,7 +42,7 @@ jobs:
 
       - name: Setup Rust
         id: setup-rust
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@v2
         with:
           rustflags: "" # keep build.rustflags; the -D warnings default belongs to the Rust job's clippy call
         background: true
@@ -138,7 +138,7 @@ jobs:
 
       - name: Setup Rust
         id: setup-rust
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@v2
         with:
           rustflags: ""
         background: true
@@ -266,7 +266,7 @@ jobs:
 
       # rustfmt and clippy come from rust-toolchain.toml's components.
       - name: Setup Rust
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@v2
         with:
           rustflags: ""
 
diff --git a/.github/workflows/fast-forward.yml b/.github/workflows/fast-forward.yml
index adcbbad9b..965345d6c 100644
--- a/.github/workflows/fast-forward.yml
+++ b/.github/workflows/fast-forward.yml
@@ -30,7 +30,7 @@ jobs:
       contains(github.event.comment.body, '/ff'))
     # Pin to a 40-char commit SHA: whoever can change that repo can effectively
     # push straight to this repository's default branch.
-    uses: arcboxlabs/actions/.github/workflows/fast-forward.yml@3b936594d02e187473fbc4ec5f814bbeba2049ac # ff-v1
+    uses: arcboxlabs/actions/.github/workflows/fast-forward.yml@df45f49fc08a2237044fc03c6044b3923cae22a9 # ff-v1
     secrets:
       app_id: ${{ secrets.BOT_APP_ID }}
       app_private_key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/release-desktop.yml b/.github/workflows/release-desktop.yml
index d6781062c..e35f77d84 100644
--- a/.github/workflows/release-desktop.yml
+++ b/.github/workflows/release-desktop.yml
@@ -123,7 +123,7 @@ jobs:
           - name: Upload GitHub Release assets
             id: release-assets
             if: ${{ github.event_name == 'push' || inputs.dry_run == false }}
-            uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
+            uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
             with:
               tag_name: ${{ steps.meta.outputs.tag }}
               # release-please creates this draft before the tag push. Keep it private while the
@@ -216,7 +216,7 @@ jobs:
         # App installation token may be refused when opening the PR on microsoft/winget-pkgs.
         if: ${{ steps.winget-token.outputs.token != '' }}
         continue-on-error: true
-        uses: vedantmgoyal9/winget-releaser@4ffc7888bffd451b357355dc214d43bb9f23917e # v2
+        uses: vedantmgoyal9/winget-releaser@b7370d4d152efdce803a26cc6ca9eee58cb2ad54 # v2
         with:
           identifier: ArcBox.LinkCode
           release-tag: ${{ steps.meta.outputs.tag }}