diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 95a53e5..49f2374 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -56,7 +56,7 @@ jobs:
       - name: Record previous tag
         id: prev-tag
         run: echo "tag=$(git describe --tags --abbrev=0 2>/dev/null || echo '')" >> "$GITHUB_OUTPUT"
-      - uses: FerrLabs/FerrFlow@ce419aeddfcc21884391320fee45a715161e6624 # v5
+      - uses: FerrLabs/FerrFlow@755d44bc01c8f47ee8602df7b69c68b72271a71d # v5
         with:
           bot: true
           dry_run: ${{ inputs.dry_run }}
@@ -80,7 +80,7 @@ jobs:
         with:
           repository: FerrLabs/FerrFlow
           path: ferrflow-src
-      - uses: dtolnay/rust-toolchain@efcb852328a9f50117170cc43094fb6f09eaf1ae # nightly
+      - uses: dtolnay/rust-toolchain@4fd1da8b0805d2d2e936788875a7d65dbd677dc2 # nightly
       - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           workspaces: ferrflow-src
diff --git a/.github/workflows/renovate-rebase.yml b/.github/workflows/renovate-rebase.yml
index 93df337..20ef403 100644
--- a/.github/workflows/renovate-rebase.yml
+++ b/.github/workflows/renovate-rebase.yml
@@ -6,7 +6,7 @@ on:
 
 jobs:
   dispatch:
-    uses: FerrLabs/.github/.github/workflows/reusable-renovate-dispatch.yml@a4b4a70d116127cd49f09ad6f363ac55fd8f6501 # main
+    uses: FerrLabs/.github/.github/workflows/reusable-renovate-dispatch.yml@2294da4af236f9adc02beaa3829afb499be0857a # main
     with:
       runner: ubuntu-latest
     secrets: inherit
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index f1db8bb..dfb58fa 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -45,6 +45,6 @@ jobs:
           retention-days: 5
 
       - name: Upload to code scanning
-        uses: github/codeql-action/upload-sarif@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4
+        uses: github/codeql-action/upload-sarif@7188fc363630916deb702c7fdcf4e481b751f97a # v4
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/security-scan.yml b/.github/workflows/security-scan.yml
index 6415718..f3b0455 100644
--- a/.github/workflows/security-scan.yml
+++ b/.github/workflows/security-scan.yml
@@ -16,5 +16,5 @@ permissions:
 jobs:
   scan:
     name: Secrets + CVE
-    uses: FerrLabs/.github/.github/workflows/reusable-security-scan.yml@2a5ffda5cd587332696bda4ad16063839d2f4139 # main
+    uses: FerrLabs/.github/.github/workflows/reusable-security-scan.yml@2294da4af236f9adc02beaa3829afb499be0857a # main
     secrets: inherit
diff --git a/action.yml b/action.yml
index 412793c..ae921e7 100644
--- a/action.yml
+++ b/action.yml
@@ -205,7 +205,7 @@ runs:
     # ------------------------------------------------------------------
     - name: Install hyperfine
       if: (inputs.type == 'full' || inputs.type == 'all') && inputs.merge-partials == ''
-      uses: taiki-e/install-action@c7eb1735f09259a5035e8e5d44b1406b1cddc0fb # v2.83.0
+      uses: taiki-e/install-action@ed67fa35ac944f3a9b33f12c4dd43b6f31a47e20 # v2.83.3
       with:
         tool: hyperfine