diff --git a/.github/workflows/link-check.yaml b/.github/workflows/link-check.yaml
index b0d9985..4850a8e 100644
--- a/.github/workflows/link-check.yaml
+++ b/.github/workflows/link-check.yaml
@@ -48,7 +48,7 @@ jobs:
 
       - name: Cache Puppeteer Chrome
         id: chrome-cache
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
+        uses: actions/cache@2c8a9bd7457de244a408f35966fab2fb45fda9c8 # v6.0.0
         with:
           path: ~/.cache/puppeteer
           key: puppeteer-${{ runner.os }}-${{ runner.arch }}-chrome-${{ env.CHROME_BUILD_ID }}
diff --git a/.github/workflows/zizmor.yaml b/.github/workflows/zizmor.yaml
index 0e721eb..384e9cb 100644
--- a/.github/workflows/zizmor.yaml
+++ b/.github/workflows/zizmor.yaml
@@ -26,7 +26,7 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor (blocking, HIGH only)
-        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+        uses: zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa # v0.5.7
         with:
           advanced-security: false
           annotations: true