diff --git a/.github/workflows/build-push.yaml b/.github/workflows/build-push.yaml
index 379a793..4648652 100644
--- a/.github/workflows/build-push.yaml
+++ b/.github/workflows/build-push.yaml
@@ -52,7 +52,7 @@ jobs:
           fi
 
       - name: GHCR Login
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -70,7 +70,7 @@ jobs:
 
       - name: GAR Login
         if: contains(inputs.docker-registry, 'pkg.dev')
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ${{ inputs.docker-registry }}
           username: oauth2accesstoken
@@ -78,14 +78,14 @@ jobs:
 
       - name: Docker Hub Login
         if: ${{ !contains(inputs.docker-registry, 'pkg.dev') }}
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           username: ${{ secrets.DOCKERHUB_USER }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}
 
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           repository: libops/.github
           path: gha
@@ -97,10 +97,10 @@ jobs:
         env:
           DOCKER_IMAGE: ${{ inputs.docker-registry }}/${{ inputs.image }}
 
-      - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: build+push
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6
         with:
           context: ${{ inputs.context }}
           file: ${{ inputs.context }}/${{ inputs.file }}
@@ -121,7 +121,7 @@ jobs:
       - build
     steps:
       - name: GHCR Login
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -139,7 +139,7 @@ jobs:
 
       - name: GAR Login
         if: contains(inputs.docker-registry, 'pkg.dev')
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ${{ inputs.docker-registry }}
           username: oauth2accesstoken
@@ -147,12 +147,12 @@ jobs:
 
       - name: Docker Hub Login
         if: ${{ !contains(inputs.docker-registry, 'pkg.dev') }}
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           username: ${{ secrets.DOCKERHUB_USER }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}
 
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           repository: libops/.github
           path: gha
@@ -165,7 +165,7 @@ jobs:
         env:
           DOCKER_IMAGE: ${{ inputs.docker-registry }}/${{ inputs.image }}
 
-      - uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3
+      - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
 
       - name: merge platform images
         run: |
diff --git a/.github/workflows/bump-release.yaml b/.github/workflows/bump-release.yaml
index 821ec41..cbafca3 100644
--- a/.github/workflows/bump-release.yaml
+++ b/.github/workflows/bump-release.yaml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: "actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8" # v6
+        uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd" # v6
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/sitectl-plugin-goreleaser.yaml b/.github/workflows/sitectl-plugin-goreleaser.yaml
index 400c7ed..9911757 100644
--- a/.github/workflows/sitectl-plugin-goreleaser.yaml
+++ b/.github/workflows/sitectl-plugin-goreleaser.yaml
@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0
 
@@ -40,7 +40,7 @@ jobs:
           git clone --depth=1 --branch "${{ inputs.sitectl-ref }}" https://github.com/libops/sitectl ../sitectl
 
       - name: Set up Go
-        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version: ${{ inputs.go-version }}
 
@@ -61,7 +61,7 @@ jobs:
           create_credentials_file: true
 
       - name: Checkout Package Publisher
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           repository: libops/terraform-linux-packages
           ref: main