diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 78a4ce8d..071aa6a9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -30,7 +30,7 @@ jobs:
         uses: "actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8" # v5
 
       - name: "Install PHP"
-        uses: "shivammathur/setup-php@0f7f1d08e3e32076e51cae65eb0b0c871405b16e" # v2
+        uses: "shivammathur/setup-php@bf6b4fbd49ca58e4608c9c89fba0b8d90bd2a39f" # v2
         with:
           coverage: "pcov"
           php-version: "${{ matrix.php-version }}"
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index cc3b3bc5..176c17a1 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -19,13 +19,13 @@ jobs:
     runs-on: ubuntu-24.04
     name: Release Automation
     steps:
-      - uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2
+      - uses: actions/create-github-app-token@67018539274d69449ef7c02e8e71183d1719ab42 # v2
         id: generate-token
         with:
           app-id: ${{ secrets.LENDABOT_APP_ID }}
           private-key: ${{ secrets.LENDABOT_APP_PRIVATE_KEY }}
 
-      - uses: googleapis/release-please-action@a02a34c4d625f9be7cb89156071d8567266a2445 # v4
+      - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4
         id: release
         with:
           token: ${{ steps.generate-token.outputs.token }}