diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 79eb467..ffbaa3d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -128,7 +128,7 @@ jobs:
         with:
           sarif: "tt-gate.sarif"
       - name: Publish findings as code-scanning annotations
-        uses: github/codeql-action/upload-sarif@5595ccaf912efad79be6eef63a5619ff05969be3 # v4.37.6
+        uses: github/codeql-action/upload-sarif@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd # v4.37.7
         with:
           sarif_file: tt-gate.sarif
 
diff --git a/.github/workflows/plugin-scan.yml b/.github/workflows/plugin-scan.yml
index 8f018ad..c25606e 100644
--- a/.github/workflows/plugin-scan.yml
+++ b/.github/workflows/plugin-scan.yml
@@ -18,7 +18,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Scan plugin with HOL Guard
-        uses: hashgraph-online/ai-plugin-scanner-action@8f0a503ca2a70c1968a9a883e11fdff5737b7909 # v1.2.514
+        uses: hashgraph-online/ai-plugin-scanner-action@55616c962cf86368423f7673b2ecdfdbe613d1af # v1.2.515
         with:
           plugin_dir: "."
           fail_on_severity: high