diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ea26d7e6..73c05cf0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -363,7 +363,7 @@ jobs:
       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5  # v4
+      uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c  # v4
 
     - name: Set up Syft
       uses: ./.github/actions/setup-syft
diff --git a/.github/workflows/codex-review.yml b/.github/workflows/codex-review.yml
index 87ae798e..c26148de 100644
--- a/.github/workflows/codex-review.yml
+++ b/.github/workflows/codex-review.yml
@@ -54,7 +54,7 @@ jobs:
 
     - name: Run Codex
       id: run_codex
-      uses: openai/codex-action@e0fdf01220eb9a88167c4898839d273e3f2609d1  # v1
+      uses: openai/codex-action@52fe01ec70a42f454c9d2ebd47598f9fd6893d56  # v1
       with:
         openai-api-key: ${{ secrets.OPENAI_API_KEY }}
         sandbox: read-only
diff --git a/.github/workflows/release-sbom.yml b/.github/workflows/release-sbom.yml
index 89060086..f939544f 100644
--- a/.github/workflows/release-sbom.yml
+++ b/.github/workflows/release-sbom.yml
@@ -57,7 +57,7 @@ jobs:
         version: ${{ env.SYFT_VERSION }}
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5  # v4
+      uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c  # v4
 
     - name: Login to GitHub Container Registry
       uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9  # v3