diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index aca644f..e23e8ad 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -25,7 +25,7 @@ jobs:
       - run: python -m build
 
       - name: generate build provenance
-        uses: actions/attest-build-provenance@bd77c077858b8d561b7a36cbe48ef4cc642ca39d # v2.2.2
+        uses: actions/attest-build-provenance@c074443f1aee8d4aeeae555aebba3282517141b2 # v2.2.3
         with:
           subject-path: "${{ github.workspace }}/dist/*"
 
diff --git a/.github/workflows/update-specs.yml b/.github/workflows/update-specs.yml
index 26f1473..920f155 100644
--- a/.github/workflows/update-specs.yml
+++ b/.github/workflows/update-specs.yml
@@ -31,7 +31,7 @@ jobs:
               "pull_requests": "write"
             }
 
-      - uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3.3.0
+      - uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # v3.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}