diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml
index b72f8973c..d5c6470cb 100644
--- a/.github/workflows/auto-release.yml
+++ b/.github/workflows/auto-release.yml
@@ -32,7 +32,7 @@ jobs:
 
       - name: Install Chromium, CJK fonts, and PDF inspection tools
         id: setupchrome
-        uses: browser-actions/setup-chrome@2e1d749697dd1612b833dba4a722266286fbefcd # v2.1.2
+        uses: browser-actions/setup-chrome@48ad923757ca74d66703209fe939badbdf80f2f4 # v2.2.0
         with:
           chrome-version: stable
 
@@ -158,7 +158,7 @@ jobs:
         run: (cd dist && sha256sum -c SHA256SUMS)
 
       - name: Attest tagged release artifacts
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: |
             dist/docker_practice-*.pdf
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 3db96323a..6efc8aae1 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -57,7 +57,7 @@ jobs:
           python3 tools/test_examples.py --require-tools
 
       - name: Install Chromium
-        uses: browser-actions/setup-chrome@2e1d749697dd1612b833dba4a722266286fbefcd # v2.1.2
+        uses: browser-actions/setup-chrome@48ad923757ca74d66703209fe939badbdf80f2f4 # v2.2.0
         with:
           chrome-version: stable
 
diff --git a/.github/workflows/preview-pdf.yml b/.github/workflows/preview-pdf.yml
index 905600954..c56085295 100644
--- a/.github/workflows/preview-pdf.yml
+++ b/.github/workflows/preview-pdf.yml
@@ -35,7 +35,7 @@ jobs:
           npm test
 
       - name: Install Chromium
-        uses: browser-actions/setup-chrome@2e1d749697dd1612b833dba4a722266286fbefcd # v2.1.2
+        uses: browser-actions/setup-chrome@48ad923757ca74d66703209fe939badbdf80f2f4 # v2.2.0
         with:
           chrome-version: stable