diff --git a/.github/workflows/codspeed.yml b/.github/workflows/codspeed.yml
index 9ad9fd9..a00444e 100644
--- a/.github/workflows/codspeed.yml
+++ b/.github/workflows/codspeed.yml
@@ -36,7 +36,7 @@ jobs:
           enable-cache: false
 
       - name: Run benchmarks under CodSpeed
-        uses: CodSpeedHQ/action@373d6868929f444bc08d901fd0eb0ad52a8875ea # v5.2.1
+        uses: CodSpeedHQ/action@c4fd08a3a159bd0cc208da1e0edf32b8c47d75e5 # v5.4.0
         with:
           mode: simulation
           run: uv run --locked --group benchmark pytest benchmarks/ --codspeed --no-cov
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 38085f7..c426bae 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -59,7 +59,7 @@ jobs:
           test -s provenance/provenance.intoto.jsonl
 
       - name: Install syft
-        uses: anchore/sbom-action/download-syft@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
+        uses: anchore/sbom-action/download-syft@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
 
       - name: Generate SBOM (CycloneDX)
         run: syft scan dir:dist -o "cyclonedx-json=provenance/docopt2.sbom.cdx.json"