diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 1ed37f9f..48c20099 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -86,7 +86,7 @@ jobs:
           done
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3
         with:
           # Release notes are curated by release-drafter; only attach the signed
           # assets here so the drafted notes are preserved.
diff --git a/.github/workflows/scorecard.yaml b/.github/workflows/scorecard.yaml
index 0735981f..01c2e0c5 100644
--- a/.github/workflows/scorecard.yaml
+++ b/.github/workflows/scorecard.yaml
@@ -78,7 +78,7 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: results.sarif
 
diff --git a/docs/requirements.txt b/docs/requirements.txt
index accfc249..a81df3c4 100644
--- a/docs/requirements.txt
+++ b/docs/requirements.txt
@@ -1,5 +1,5 @@
 mkdocs-material ==9.7.7
-pymdown-extensions ==11.0.1
+pymdown-extensions ==11.0.2
 mkdocs-glightbox == 0.5.2
 mkdocs-include-markdown-plugin == 7.3.0
 mkdocs-panzoom-plugin == 0.5.2
diff --git a/examples/blob/cluster-workflow-template.yaml b/examples/blob/cluster-workflow-template.yaml
index a7cf6c18..e674b3d0 100644
--- a/examples/blob/cluster-workflow-template.yaml
+++ b/examples/blob/cluster-workflow-template.yaml
@@ -76,7 +76,7 @@ spec:
         limit: "2"
 
       script:
-        image: amazon/aws-cli:2.36.29
+        image: amazon/aws-cli:2.36.34
         command: [sh, -c]
         volumeMounts:
           - &dstSecretMount
@@ -129,7 +129,7 @@ spec:
 
     - name: determine-size-s3
       script:
-        image: amazon/aws-cli:2.36.29
+        image: amazon/aws-cli:2.36.34
         command: [sh, -c]
         volumeMounts:
           - &srcSecretMount
@@ -211,7 +211,7 @@ spec:
           persistentVolumeClaim:
             claimName: "{{ workflow.name }}"
       script:
-        image: amazon/aws-cli:2.36.29
+        image: amazon/aws-cli:2.36.34
         command: [sh, -c]
         volumeMounts:
           - &workDirMount
@@ -268,7 +268,7 @@ spec:
       volumes:
         - *workDir
       script:
-        image: amazon/aws-cli:2.36.29
+        image: amazon/aws-cli:2.36.34
         command: [sh, -c]
         volumeMounts:
           - *workDirMount