diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 34aed37..58ae132 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -12,7 +12,7 @@ jobs:
   # Mirrors check.yml's go-check job: the multi-module gate runs through the
   # Makefile via the shared go-check.yml (lint per module inside make test).
   go-check:
-    uses: duynhlab/gha-workflows/.github/workflows/go-check.yml@5179402dc1ae410e8964c85926b830481df87360 # main # main
+    uses: duynhlab/gha-workflows/.github/workflows/go-check.yml@54fd20d46fd99b5fb85e6029247fcaba865c1481 # main # main
     with:
       command-test: 'make test TAGS=integration && git diff --exit-code && make coverage'
       gomod-path: 'obsx/go.mod' # any module works: all pin the same go directive
@@ -21,7 +21,7 @@ jobs:
 
   sonar:
     needs: go-check
-    uses: duynhlab/gha-workflows/.github/workflows/sonarqube.yml@5179402dc1ae410e8964c85926b830481df87360 # main # main
+    uses: duynhlab/gha-workflows/.github/workflows/sonarqube.yml@54fd20d46fd99b5fb85e6029247fcaba865c1481 # main # main
     with:
       project-key: 'duynhlab_pkg'
       organization: 'duynhlab'
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 83d19bc..2e3aad9 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -16,7 +16,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: read
-    uses: duynhlab/gha-workflows/.github/workflows/go-check.yml@5179402dc1ae410e8964c85926b830481df87360 # main # main
+    uses: duynhlab/gha-workflows/.github/workflows/go-check.yml@54fd20d46fd99b5fb85e6029247fcaba865c1481 # main # main
     with:
       command-test: 'make test TAGS=integration && git diff --exit-code && make coverage'
       gomod-path: 'obsx/go.mod' # any module works: all pin the same go directive
@@ -31,7 +31,7 @@ jobs:
       contents: read
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: bufbuild/buf-action@8c6a16e16f12ba20b6470afa9c2ba9b5ba8c97c3 # v1
+      - uses: bufbuild/buf-action@85aebf73123b5c15fd5528aaecbf9129cddf7fa7 # v1.6.0
         with:
           lint: true
           format: true
@@ -59,7 +59,7 @@ jobs:
     permissions:
       contents: read
       pull-requests: read # sonarqube.yml's job requests this
-    uses: duynhlab/gha-workflows/.github/workflows/sonarqube.yml@5179402dc1ae410e8964c85926b830481df87360 # main # main
+    uses: duynhlab/gha-workflows/.github/workflows/sonarqube.yml@54fd20d46fd99b5fb85e6029247fcaba865c1481 # main # main
     with:
       project-key: 'duynhlab_pkg'
       organization: 'duynhlab'
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index e2deabf..7c4288f 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -18,7 +18,7 @@ permissions:
 
 jobs:
   go:
-    uses: duynhlab/gha-workflows/.github/workflows/codeql.yml@5179402dc1ae410e8964c85926b830481df87360 # main # main
+    uses: duynhlab/gha-workflows/.github/workflows/codeql.yml@54fd20d46fd99b5fb85e6029247fcaba865c1481 # main # main
     permissions:
       actions: read
       contents: read
@@ -30,7 +30,7 @@ jobs:
       go-version-file: obsx/go.mod # any module works: all pin the same go directive
 
   actions:
-    uses: duynhlab/gha-workflows/.github/workflows/codeql.yml@5179402dc1ae410e8964c85926b830481df87360 # main # main
+    uses: duynhlab/gha-workflows/.github/workflows/codeql.yml@54fd20d46fd99b5fb85e6029247fcaba865c1481 # main # main
     permissions:
       actions: read
       contents: read