diff --git a/.github/workflows/call-github2gerrit.yaml b/.github/workflows/call-github2gerrit.yaml
index 7f788f55..55f52b93 100644
--- a/.github/workflows/call-github2gerrit.yaml
+++ b/.github/workflows/call-github2gerrit.yaml
@@ -67,7 +67,7 @@ jobs:
       pull-requests: write  # comment on and close mirrored PRs
       issues: write  # manage PR/issue metadata during mirroring
     # yamllint disable-line rule:line-length
-    uses: lfreleng-actions/github2gerrit-action/.github/workflows/github2gerrit.yaml@f44ab263b27a93ea20af8a13647fdaaafa3da4eb  # v2.0.0
+    uses: lfreleng-actions/github2gerrit-action/.github/workflows/github2gerrit.yaml@3d548cc0cd8e04175da73a7dc3449b312ce67e07  # v2.1.0
     with:
       USE_PR_AS_COMMIT: true
       GERRIT_KNOWN_HOSTS: ${{ vars.GERRIT_KNOWN_HOSTS }}
diff --git a/.github/workflows/gerrit-clm.yaml b/.github/workflows/gerrit-clm.yaml
index 59c96347..5642fa7d 100644
--- a/.github/workflows/gerrit-clm.yaml
+++ b/.github/workflows/gerrit-clm.yaml
@@ -102,7 +102,7 @@ jobs:
     steps:
       - name: 'Harden runner'
         # yamllint disable-line rule:line-length
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: audit
       - name: 'Clear votes'
@@ -129,7 +129,7 @@ jobs:
     permissions:
       contents: read
     # yamllint disable-line rule:line-length
-    uses: lfreleng-actions/security-workflows/.github/workflows/sonatype-lifecycle.yaml@5882f138dd24fcd6cb4ebc8bb3a68cee45a437a6  # v0.3.0
+    uses: lfreleng-actions/security-workflows/.github/workflows/sonatype-lifecycle.yaml@b2d87d2663b3eedf263cd21b9f45c6322d119a27  # v0.5.1
     with:
       # Build before scanning: Nexus IQ identifies far more components
       # from the packaged output than from source alone. Neither the
@@ -180,7 +180,7 @@ jobs:
     steps:
       - name: 'Harden runner'
         # yamllint disable-line rule:line-length
-        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c  # v2.21.0
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1  # v2.21.1
         with:
           egress-policy: audit
       - name: 'Get workflow conclusion'
diff --git a/.github/workflows/open-ssf-scorecard.yaml b/.github/workflows/open-ssf-scorecard.yaml
index e5efc849..57ef3c1e 100644
--- a/.github/workflows/open-ssf-scorecard.yaml
+++ b/.github/workflows/open-ssf-scorecard.yaml
@@ -39,7 +39,7 @@ jobs:
   openssf-scorecard:
     name: "OpenSSF Scorecard"
     # yamllint disable-line rule:line-length
-    uses: lfit/releng-reusable-workflows/.github/workflows/reuse-openssf-scorecard.yaml@dd7e7f1359ca34ca29a409354fcc648b4ec7a561 # v0.10.2
+    uses: lfit/releng-reusable-workflows/.github/workflows/reuse-openssf-scorecard.yaml@87eacd1f8322263ebbc1411ce2ea82bab10ed091 # v0.10.3
     permissions:
       # Needed to upload the results to code-scanning dashboard.
       security-events: write