diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index db0f5dba..d6891c55 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -145,7 +145,7 @@ jobs:
 
       - name: Build snapshot
         if: ${{ !startsWith(github.ref, 'refs/tags/') }}
-        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
         with:
           # renovate: github=goreleaser/goreleaser
           version: v2.18.3
@@ -153,7 +153,7 @@ jobs:
 
       - name: Build release
         if: ${{ startsWith(github.ref, 'refs/tags/') }}
-        uses: goreleaser/goreleaser-action@f06c13b6b1a9625abc9e6e439d9c05a8f2190e94 # v7.2.3
+        uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
         with:
           # renovate: github=goreleaser/goreleaser
           version: v2.18.3
diff --git a/.github/workflows/mixin.yml b/.github/workflows/mixin.yml
index 9ab946b0..67c4064a 100644
--- a/.github/workflows/mixin.yml
+++ b/.github/workflows/mixin.yml
@@ -57,7 +57,7 @@ jobs:
           go-version-file: go.mod
 
       - name: Install and cache pinned mixin tools
-        uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1
+        uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0
         with:
           working_directory: contrib/mixin
 
diff --git a/.github/workflows/runbooks.yml b/.github/workflows/runbooks.yml
index ad95db43..891b9145 100644
--- a/.github/workflows/runbooks.yml
+++ b/.github/workflows/runbooks.yml
@@ -61,7 +61,7 @@ jobs:
           go-version-file: go.mod
 
       - name: Install and cache pinned mixin tools
-        uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca # v5.1.1
+        uses: jdx/mise-action@9b200bcecbfd6303e69a4a261b2e09e3757440a7 # v5.2.0
         with:
           working_directory: contrib/mixin