diff --git a/.github/workflows/bpf-next.yaml b/.github/workflows/bpf-next.yaml
index 1f01cf2a..5441c928 100644
--- a/.github/workflows/bpf-next.yaml
+++ b/.github/workflows/bpf-next.yaml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: checkout
-        uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
       - name: commit
         id: commit
         run: |
diff --git a/.github/workflows/buildx-stage.yaml b/.github/workflows/buildx-stage.yaml
index 6ae8a128..118c6d56 100644
--- a/.github/workflows/buildx-stage.yaml
+++ b/.github/workflows/buildx-stage.yaml
@@ -41,7 +41,7 @@ jobs:
     runs-on: ${{ inputs.runner }}
     steps:
       - name: Checkout
-        uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
         with:
           ref: ${{ github.event.pull_request.head.ref }}
 
@@ -67,7 +67,7 @@ jobs:
 
       - name: download first patch
         if: ${{ steps.check.outputs.build == 'y' && inputs.apply-patch != '' }}
-        uses: actions/download-artifact@9c19ed7fe5d278cd354c7dfd5d3b88589c7e2395 # v4.1.6
+        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
         with:
            name: ${{ inputs.apply-patch }}
            path: /tmp/
@@ -82,7 +82,7 @@ jobs:
 
       - name: download second patch
         if: ${{ steps.check.outputs.build == 'y' && inputs.apply-patch-2 != '' }}
-        uses: actions/download-artifact@9c19ed7fe5d278cd354c7dfd5d3b88589c7e2395 # v4.1.6
+        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
         with:
            name: ${{ inputs.apply-patch-2 }}
            path: /tmp/
@@ -143,7 +143,7 @@ jobs:
 
       - name: upload patch
         if: ${{ inputs.patch-cmd != '' }}
-        uses: actions/upload-artifact@1746f4ab65b179e0ea60a494b83293b640dd5bba # v4.3.2
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
         with:
           name: ${{ inputs.name }}.patch
           path: ${{ inputs.name }}.patch
diff --git a/.github/workflows/buildx.yaml b/.github/workflows/buildx.yaml
index 49b6585c..3c7a2103 100644
--- a/.github/workflows/buildx.yaml
+++ b/.github/workflows/buildx.yaml
@@ -251,11 +251,11 @@ jobs:
       sha: ${{ steps.push.outputs.sha }}
     steps:
       - name: checkout
-        uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
         with:
           ref: ${{ github.event.pull_request.head.ref }}
       - name: download all artifacts
-        uses: actions/download-artifact@9c19ed7fe5d278cd354c7dfd5d3b88589c7e2395 # v4.1.6
+        uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
         with:
           path: /tmp/artifacts
       - name: push new version
@@ -333,7 +333,7 @@ jobs:
            [ $success -eq 1 ] || exit 42
 
       - name: checkout
-        uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
         with:
           ref: ${{ needs.commit-changes.outputs.sha }}
 
diff --git a/.github/workflows/renovate-config-validator.yaml b/.github/workflows/renovate-config-validator.yaml
index 95705579..d82b6988 100644
--- a/.github/workflows/renovate-config-validator.yaml
+++ b/.github/workflows/renovate-config-validator.yaml
@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout configuration
-        uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
 
       # this step uses latest renovate slim release
       - name: Validate configuration
diff --git a/.github/workflows/tag-images-releases.yaml b/.github/workflows/tag-images-releases.yaml
index 035db45a..e82b7354 100644
--- a/.github/workflows/tag-images-releases.yaml
+++ b/.github/workflows/tag-images-releases.yaml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: checkout
-        uses: actions/checkout@1d96c772d19495a3b5c517cd2bc0cb401ea0529f # v4.1.3
+        uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
       - name: Getting image tag
         id: tag
         run: |