diff --git a/.github/workflows/nuget_release.yml b/.github/workflows/nuget_release.yml
index bad7b00..7659bba 100644
--- a/.github/workflows/nuget_release.yml
+++ b/.github/workflows/nuget_release.yml
@@ -54,7 +54,7 @@ jobs:
           --health-retries=10
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411  # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920  # v2.20.0
         with:
           # Audit first. After reviewing the audit run, switch to 'block' with a
           # tuned allowed-endpoints list (see GITHUB_ACTIONS_HARDENING_ROLLOUT.md).
@@ -111,7 +111,7 @@ jobs:
       version: ${{ steps.version.outputs.version }}
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411  # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920  # v2.20.0
         with:
           egress-policy: audit
       - name: Checkout
@@ -182,7 +182,7 @@ jobs:
       attestations: write   # write the SLSA build-provenance attestation
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411  # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920  # v2.20.0
         with:
           egress-policy: audit
       - name: Download package artifact
diff --git a/.github/workflows/pull_request.yml b/.github/workflows/pull_request.yml
index 3e00dfb..ee3e990 100644
--- a/.github/workflows/pull_request.yml
+++ b/.github/workflows/pull_request.yml
@@ -44,7 +44,7 @@ jobs:
           --health-retries=10
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411  # v2.19.4
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920  # v2.20.0
         with:
           egress-policy: audit
       - name: Checkout