diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 21bdca45..f7b7a5df 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -66,7 +66,7 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2
+        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d  # v4.38.3
         with:
           languages: ${{ matrix.language }}
           # Both languages are interpreted, so there is nothing to compile.
@@ -75,6 +75,6 @@ jobs:
           build-mode: none
 
       - name: Perform CodeQL analysis
-        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2
+        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d  # v4.38.3
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/regenerate-artifacts.yml b/.github/workflows/regenerate-artifacts.yml
index 9de031c7..d6ac7de9 100644
--- a/.github/workflows/regenerate-artifacts.yml
+++ b/.github/workflows/regenerate-artifacts.yml
@@ -277,7 +277,7 @@ jobs:
 
       - name: Mint the App token
         id: app
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1  # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510  # v3.3.0
         with:
           client-id: ${{ secrets.REGENERATE_ARTIFACTS_APP_CLIENT_ID }}
           private-key: ${{ secrets.REGENERATE_ARTIFACTS_APP_PRIVATE_KEY }}