diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index f94dd1b..8646d65 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -40,7 +40,7 @@ jobs:
           persist-credentials: false
 
       - name: run scorecard analysis
-        uses: ossf/scorecard-action@v2.4.3
+        uses: ossf/scorecard-action@v2.4.4
         with:
           results_file: results.sarif
           results_format: sarif
@@ -49,7 +49,7 @@ jobs:
           publish_results: true
 
       - name: upload SARIF to security tab
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@v4.37.3
         with:
           sarif_file: results.sarif
           category: scorecard
diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml
index cc43193..dbbe15a 100644
--- a/.github/workflows/supply-chain.yml
+++ b/.github/workflows/supply-chain.yml
@@ -101,7 +101,7 @@ jobs:
           osv-scanner --sbom=sbom/bom.json --format table
       - name: upload SARIF
         if: always()
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@v4.37.3
         with:
           sarif_file: osv-results.sarif
           category: osv-scanner