diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 38b44e4..d6d36c1 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -30,6 +30,6 @@ jobs:
           name: scorecard-results
           path: results.sarif
           retention-days: 5
-      - uses: github/codeql-action/upload-sarif@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1
+      - uses: github/codeql-action/upload-sarif@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/sync-spec.yml b/.github/workflows/sync-spec.yml
index fdad129..a248455 100644
--- a/.github/workflows/sync-spec.yml
+++ b/.github/workflows/sync-spec.yml
@@ -68,7 +68,7 @@ jobs:
         run: |
           if [ -s sync.patch ]; then git apply sync.patch; fi
           rm sync.patch
-      - uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+      - uses: peter-evans/create-pull-request@15733dbdfeedb4f7fdb73d13c6f5ac83b710fab8 # v8.1.2
         with:
           branch: sync/opencode-${{ needs.generate.outputs.version }}
           title: "Sync with OpenCode ${{ needs.generate.outputs.version }}"