diff --git a/.github/workflows/ci-dir-gnoland.yml b/.github/workflows/ci-dir-gnoland.yml
index aecb5830a82..86d54cad347 100644
--- a/.github/workflows/ci-dir-gnoland.yml
+++ b/.github/workflows/ci-dir-gnoland.yml
@@ -39,7 +39,7 @@ jobs:
       - uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: go.mod
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: lts/Jod
       - run: |
@@ -54,7 +54,7 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: lts/Jod
       - run: make -C gno.land/pkg/gnoweb/frontend lint.ci
diff --git a/.github/workflows/meta-codeql.yml b/.github/workflows/meta-codeql.yml
index 029f8fb4c26..9c02f85b139 100644
--- a/.github/workflows/meta-codeql.yml
+++ b/.github/workflows/meta-codeql.yml
@@ -32,10 +32,10 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: github/codeql-action/init@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
+      - uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           languages: go
           build-mode: autobuild
-      - uses: github/codeql-action/analyze@54f647b7e1bb85c95cddabcd46b0c578ec92bc1a # v4.36.3
+      - uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4.37.0
         with:
           category: "/language:go"
diff --git a/.github/workflows/meta-gh-labeler.yml b/.github/workflows/meta-gh-labeler.yml
index cc99dbdd10f..afcd466ef26 100644
--- a/.github/workflows/meta-gh-labeler.yml
+++ b/.github/workflows/meta-gh-labeler.yml
@@ -15,4 +15,4 @@ jobs:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
-      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213 # v6.1.0
+      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
diff --git a/.github/workflows/meta-gh-stale.yml b/.github/workflows/meta-gh-stale.yml
index e6bafc81564..65d088338c8 100644
--- a/.github/workflows/meta-gh-stale.yml
+++ b/.github/workflows/meta-gh-stale.yml
@@ -11,7 +11,7 @@ jobs:
       pull-requests: write # to close and label stale PRs
       issues: write # to close and label stale issues
     steps:
-      - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
+      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
         with:
           # actions/stale's cache mechanism doesn't work if you have a non-trivial
           # amount of other caches: https://github.com/actions/stale/issues/1136