diff --git a/.forgejo/actions/prepare-docker-build/action.yml b/.forgejo/actions/prepare-docker-build/action.yml
index 74bd029d6..2ac6b8121 100644
--- a/.forgejo/actions/prepare-docker-build/action.yml
+++ b/.forgejo/actions/prepare-docker-build/action.yml
@@ -75,7 +75,7 @@ runs:
 
     - name: Set up QEMU
       if: ${{ env.BUILDKIT_ENDPOINT == '' }}
-      uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
+      uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4
 
     - name: Login to builtin registry
       if: ${{ env.BUILTIN_REGISTRY_ENABLED == 'true' }}
diff --git a/.forgejo/actions/timelord/action.yml b/.forgejo/actions/timelord/action.yml
index 6121e873d..49b8df498 100644
--- a/.forgejo/actions/timelord/action.yml
+++ b/.forgejo/actions/timelord/action.yml
@@ -71,7 +71,7 @@ runs:
 
     - name: Install timelord-cli and git-warp-time
       if: steps.check-binaries.outputs.need-install == 'true'
-      uses: https://github.com/taiki-e/install-action@b6ff580856c41316412a0b9b60540fbc6f8c82cc # v2
+      uses: https://github.com/taiki-e/install-action@e67fa11c4b9316fa714ddf0abed07a0c3143b95b # v2
       with:
         tool: git-warp-time,timelord-cli@3.0.1
 
diff --git a/.forgejo/workflows/build-nix.yml b/.forgejo/workflows/build-nix.yml
index e19cf193f..ee16f0d25 100644
--- a/.forgejo/workflows/build-nix.yml
+++ b/.forgejo/workflows/build-nix.yml
@@ -65,7 +65,7 @@ jobs:
           path: binaries
           merge-multiple: true
       - name: Create Release and Upload
-        uses: https://github.com/softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
+        uses: https://github.com/softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3
         with:
           draft: true
           files: binaries/*
diff --git a/.forgejo/workflows/mirror-images.yml b/.forgejo/workflows/mirror-images.yml
index 1cd7c8f8f..cf0a66bb8 100644
--- a/.forgejo/workflows/mirror-images.yml
+++ b/.forgejo/workflows/mirror-images.yml
@@ -55,7 +55,7 @@ jobs:
       #     repositories: continuwuity
 
       - name: Install regsync
-        uses: https://github.com/regclient/actions/regsync-installer@78eb729dbdb4ef6480e85ff697b4410e22112583 # main
+        uses: https://github.com/regclient/actions/regsync-installer@f9ceff9bbbc63cd1008e60cec2b27627eedc7322 # main
 
       - name: Check what images need mirroring
         run: |
diff --git a/.forgejo/workflows/release-image.yml b/.forgejo/workflows/release-image.yml
index 80826d657..3fac48050 100644
--- a/.forgejo/workflows/release-image.yml
+++ b/.forgejo/workflows/release-image.yml
@@ -218,7 +218,7 @@ jobs:
           path: binaries
           merge-multiple: true
       - name: Create Release and Upload
-        uses: https://github.com/softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3
+        uses: https://github.com/softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3
         with:
           draft: true
           files: binaries/*