diff --git a/.github/workflows/lint-workflows.yml b/.github/workflows/lint-workflows.yml
index ac20be89c..b710aa910 100644
--- a/.github/workflows/lint-workflows.yml
+++ b/.github/workflows/lint-workflows.yml
@@ -47,4 +47,4 @@ jobs:
     - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
-    - uses: zizmorcore/zizmor-action@6fc4b006235f201fdab3722e17240ab420d580e5 # v0.6.1
+    - uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
diff --git a/.github/workflows/release-from-upstream.yml b/.github/workflows/release-from-upstream.yml
index 98f3e27f7..15351e8b0 100644
--- a/.github/workflows/release-from-upstream.yml
+++ b/.github/workflows/release-from-upstream.yml
@@ -452,7 +452,7 @@ jobs:
 
     - name: Attest release artifacts
       id: attest
-      uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
+      uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
       with:
         subject-path: 'release-artifacts/*.tar.*'
 
@@ -505,7 +505,7 @@ jobs:
 
     - name: Attest upstream source binding
       id: source-binding-attest
-      uses: actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6 # v4.2.0
+      uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
       with:
         subject-path: 'release-artifacts/*.tar.*'
         predicate-type: 'urn:aws:libfabric:attestation:upstream-binding:v1'