diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 1d4c93090f..e65a988def 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -30,10 +30,10 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee  # v4.39.0
+        uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370  # v4.39.1
         with:
           languages: ${{ matrix.language }}
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@6f2ac81f5cd81fe351a197ba0b00d91d03cd2aee  # v4.39.0
+        uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370  # v4.39.1
         with:
           category: /language:${{ matrix.language }}
diff --git a/.github/workflows/gemini-dispatch.yml b/.github/workflows/gemini-dispatch.yml
index bbb705227e..badaf7954f 100644
--- a/.github/workflows/gemini-dispatch.yml
+++ b/.github/workflows/gemini-dispatch.yml
@@ -54,7 +54,7 @@ jobs:
         id: mint_identity_token
         if: |-
           ${{ vars.APP_ID }}
-        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf  # ratchet:actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510  # ratchet:actions/create-github-app-token@v2
         with:
           app-id: ${{ vars.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
@@ -63,7 +63,7 @@ jobs:
           permission-pull-requests: write
       - name: Extract command
         id: extract_command
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea  # ratchet:actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # ratchet:actions/github-script@v7
         env:
           EVENT_TYPE: ${{ github.event_name }}.${{ github.event.action }}
           REQUEST: ${{ github.event.comment.body || github.event.issue.body }}
@@ -119,7 +119,7 @@ jobs:
         id: mint_identity_token
         if: |-
           ${{ vars.APP_ID }}
-        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf  # ratchet:actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510  # ratchet:actions/create-github-app-token@v2
         with:
           app-id: ${{ vars.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
diff --git a/.github/workflows/gemini-scheduled-triage.yml b/.github/workflows/gemini-scheduled-triage.yml
index 5fd4957623..8074a9de87 100644
--- a/.github/workflows/gemini-scheduled-triage.yml
+++ b/.github/workflows/gemini-scheduled-triage.yml
@@ -31,7 +31,7 @@ jobs:
     steps:
       - name: Get repository labels
         id: get_labels
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # ratchet:actions/github-script@v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # ratchet:actions/github-script@v9.0.0
         with:
           # NOTE: we intentionally do not use the minted token. The default
           # GITHUB_TOKEN provided by the action has enough permissions to read
@@ -153,7 +153,7 @@ jobs:
         id: mint_identity_token
         if: |-
           ${{ vars.APP_ID }}
-        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf  # ratchet:actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510  # ratchet:actions/create-github-app-token@v2
         with:
           app-id: ${{ vars.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
@@ -165,7 +165,7 @@ jobs:
           AVAILABLE_LABELS: ${{ needs.triage.outputs.available_labels }}
           ISSUE_NUMBERS: ${{ needs.triage.outputs.issue_numbers }}
           TRIAGED_ISSUES: ${{ needs.triage.outputs.triaged_issues }}
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # ratchet:actions/github-script@v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # ratchet:actions/github-script@v9.0.0
         with:
           # Use the provided token so that the "gemini-cli" is the actor in the
           # log for what changed the labels.
diff --git a/.github/workflows/gemini-triage.yml b/.github/workflows/gemini-triage.yml
index e0ebdcf1dd..0940c5666a 100644
--- a/.github/workflows/gemini-triage.yml
+++ b/.github/workflows/gemini-triage.yml
@@ -28,7 +28,7 @@ jobs:
     steps:
       - name: Get repository labels
         id: get_labels
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # ratchet:actions/github-script@v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # ratchet:actions/github-script@v9.0.0
         with:
           # NOTE: we intentionally do not use the given token. The default
           # GITHUB_TOKEN provided by the action has enough permissions to read
@@ -122,7 +122,7 @@ jobs:
         id: mint_identity_token
         if: |-
           ${{ vars.APP_ID }}
-        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf  # ratchet:actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510  # ratchet:actions/create-github-app-token@v2
         with:
           app-id: ${{ vars.APP_ID }}
           private-key: ${{ secrets.APP_PRIVATE_KEY }}
@@ -134,7 +134,7 @@ jobs:
           ISSUE_NUMBER: ${{ github.event.issue.number }}
           AVAILABLE_LABELS: ${{ needs.triage.outputs.available_labels }}
           SELECTED_LABELS: ${{ needs.triage.outputs.selected_labels }}
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd  # ratchet:actions/github-script@v8.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3  # ratchet:actions/github-script@v9.0.0
         with:
           # Use the provided token so that the "gemini-cli" is the actor in the
           # log for what changed the labels.