diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index cb42ea3..91ed659 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
         
@@ -35,7 +35,7 @@ jobs:
 
         # This encapsulates: login, qemu, build/push
       - name: Build and push image to staging prime registry
-        uses: rancher/ecm-distro-tools/actions/publish-image@c7c07fc1b7ca15c3a8fca06899a6a5657d34ac35 # master
+        uses: rancher/ecm-distro-tools/actions/publish-image@e72982e61644408c47b5c181e7ea331532d180d1 # master
         with:
           image: rancher-ai-mcp
           tag: ${{ github.ref_name }}
diff --git a/.github/workflows/renovate-vault.yml b/.github/workflows/renovate-vault.yml
index 6f123d2..3831539 100644
--- a/.github/workflows/renovate-vault.yml
+++ b/.github/workflows/renovate-vault.yml
@@ -24,7 +24,7 @@ jobs:
     permissions:
       contents: read
       id-token: write # for rancher-eio/read-vault-secrets
-    uses: rancher/renovate-config/.github/workflows/renovate-vault.yml@206454e9db716874cfd0a44a2a64d13b4a48bdaa # release
+    uses: rancher/renovate-config/.github/workflows/renovate-vault.yml@f70e54e966029a6ca076fb2893b9b4eee3f032cb # release
     with:
       logLevel: ${{ inputs.logLevel || 'info' }}
       overrideSchedule: ${{ github.event.inputs.overrideSchedule == 'true' && '{''schedule'':null}' || '' }}