diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ffbaa3d..5406b89 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -128,7 +128,7 @@ jobs:
         with:
           sarif: "tt-gate.sarif"
       - name: Publish findings as code-scanning annotations
-        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
+        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
         with:
           sarif_file: tt-gate.sarif
 
diff --git a/.github/workflows/plugin-scan.yml b/.github/workflows/plugin-scan.yml
index c25606e..a2ce7c6 100644
--- a/.github/workflows/plugin-scan.yml
+++ b/.github/workflows/plugin-scan.yml
@@ -18,7 +18,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Scan plugin with HOL Guard
-        uses: hashgraph-online/ai-plugin-scanner-action@55616c962cf86368423f7673b2ecdfdbe613d1af # v1.2.515
+        uses: hashgraph-online/ai-plugin-scanner-action@5d17bb20ed8878ef1e82ed3ddf433522dbd36b26 # v1.2.532
         with:
           plugin_dir: "."
           fail_on_severity: high