diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index cb1fa88a1023..4c6881778b27 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -37,12 +37,12 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v6
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@v4.35.3
         with:
           languages: ${{ matrix.language }}
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v4
+        uses: github/codeql-action/autobuild@v4.35.3
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@v4.35.3
         with:
           category: "Security"
diff --git a/.github/workflows/daily-repo-status.lock.yml b/.github/workflows/daily-repo-status.lock.yml
index 35eb5d409a48..79b4c33f1b36 100644
--- a/.github/workflows/daily-repo-status.lock.yml
+++ b/.github/workflows/daily-repo-status.lock.yml
@@ -54,7 +54,7 @@ jobs:
       comment_repo: ""
     steps:
       - name: Setup
-        uses: github/gh-aw/actions/setup@f01a9d118afa6e306f3645ca31e43f4ea8fb4d22 # v0.45.
+        uses: github/gh-aw/actions/setup@2f2a6f572b9038823081cb9d408f235e1a109a0b # v0.45.
         with:
           destination: /opt/gh-aw/
       - name: Check workflow file
@@ -96,7 +96,7 @@ jobs:
       secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}
     steps:
       - name: Setup
-        uses: github/gh-aw/actions/setup@f01a9d118afa6e306f3645ca31e43f4ea8fb4d22 # v0.45.
+        uses: github/gh-aw/actions/setup@2f2a6f572b9038823081cb9d408f235e1a109a0b # v0.45.
         with:
           destination: /opt/gh-aw/
       - name: Checkout
@@ -784,7 +784,7 @@ jobs:
       total_count: ${{ steps.missing_tool.outputs.total_count }}
     steps:
       - name: Setup
-        uses: github/gh-aw/actions/setup@f01a9d118afa6e306f3645ca31e43f4ea8fb4d22 # v0.45.
+        uses: github/gh-aw/actions/setup@2f2a6f572b9038823081cb9d408f235e1a109a0b # v0.45.
         with:
           destination: /opt/gh-aw/
       - name: Download agent output
@@ -881,7 +881,7 @@ jobs:
       success: ${{ steps.parse_results.outputs.success }}
     steps:
       - name: Setup
-        uses: github/gh-aw/actions/setup@f01a9d118afa6e306f3645ca31e43f4ea8fb4d22 # v0.45.
+        uses: github/gh-aw/actions/setup@2f2a6f572b9038823081cb9d408f235e1a109a0b # v0.45.
         with:
           destination: /opt/gh-aw/
       - name: Download agent
@@ -993,7 +993,7 @@ jobs:
       process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}
     steps:
       - name: Setup
-        uses: github/gh-aw/actions/setup@f01a9d118afa6e306f3645ca31e43f4ea8fb4d22 # v0.45.
+        uses: github/gh-aw/actions/setup@2f2a6f572b9038823081cb9d408f235e1a109a0b # v0.45.
         with:
           destination: /opt/gh-aw/
       - name: Download agent output
diff --git a/.github/workflows/issue-triage-agent.lock.yml b/.github/workflows/issue-triage-agent.lock.yml
index 1c3d11a800e6..6d21ee4d86c6 100644
--- a/.github/workflows/issue-triage-agent.lock.yml
+++ b/.github/workflows/issue-triage-agent.lock.yml
@@ -53,7 +53,7 @@ jobs:
       comment_repo: ""
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw/actions/setup@f01a9d118afa6e306f3645ca31e43f4ea8fb4d22 # v0.71.1
+        uses: github/gh-aw/actions/setup@2f2a6f572b9038823081cb9d408f235e1a109a0b # v0.71.3
         with:
           destination: /opt/gh-aw/actions
       - name: Check workflow file timestamps
@@ -91,7 +91,7 @@ jobs:
       secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw/actions/setup@f01a9d118afa6e306f3645ca31e43f4ea8fb4d22 # v0.71.1
+        uses: github/gh-aw/actions/setup@2f2a6f572b9038823081cb9d408f235e1a109a0b # v0.71.3
         with:
           destination: /opt/gh-aw/actions
       - name: Checkout repository
@@ -780,7 +780,7 @@ jobs:
       total_count: ${{ steps.missing_tool.outputs.total_count }}
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw/actions/setup@f01a9d118afa6e306f3645ca31e43f4ea8fb4d22 # v0.71.1
+        uses: github/gh-aw/actions/setup@2f2a6f572b9038823081cb9d408f235e1a109a0b # v0.71.3
         with:
           destination: /opt/gh-aw/actions
       - name: Download agent output artifact
@@ -874,7 +874,7 @@ jobs:
       success: ${{ steps.parse_results.outputs.success }}
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw/actions/setup@f01a9d118afa6e306f3645ca31e43f4ea8fb4d22 # v0.71.1
+        uses: github/gh-aw/actions/setup@2f2a6f572b9038823081cb9d408f235e1a109a0b # v0.71.3
         with:
           destination: /opt/gh-aw/actions
       - name: Download agent artifacts
@@ -987,7 +987,7 @@ jobs:
       process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw/actions/setup@f01a9d118afa6e306f3645ca31e43f4ea8fb4d22 # v0.71.1
+        uses: github/gh-aw/actions/setup@2f2a6f572b9038823081cb9d408f235e1a109a0b # v0.71.3
         with:
           destination: /opt/gh-aw/actions
       - name: Download agent output artifact