diff --git a/.github/workflows/renovate.yml b/.github/workflows/renovate.yml
index 0b8505e..25fe935 100644
--- a/.github/workflows/renovate.yml
+++ b/.github/workflows/renovate.yml
@@ -58,6 +58,6 @@ jobs:
           private-key: "${{ secrets.WE_RENOVATE_GITHUB_PRIVATE_KEY }}"
 
       - name: 💡 Self-hosted Renovate
-        uses: renovatebot/github-action@2d90417499f45ff78a09586f7b9874b19817dba3 # v40.1.0
+        uses: renovatebot/github-action@7d358366277001f3316d7fa54ff49a81c0158948 # v40.1.7
         with:
           token: "${{ steps.app-token.outputs.token }}"
diff --git a/.github/workflows/tf-conventional-commits.yml b/.github/workflows/tf-conventional-commits.yml
index 34ba105..c01ce93 100644
--- a/.github/workflows/tf-conventional-commits.yml
+++ b/.github/workflows/tf-conventional-commits.yml
@@ -9,7 +9,7 @@ jobs:
   verify-commits:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
         # https://github.com/taskmedia/action-conventional-commits
       - uses: taskmedia/action-conventional-commits@v1.1.15
diff --git a/action.yml b/action.yml
index e825397..45382b1 100644
--- a/action.yml
+++ b/action.yml
@@ -60,7 +60,7 @@ runs:
     - name: Release with semantic-release
       id: release
       if: ${{ inputs.release == 'true' }}
-      uses: cycjimmy/semantic-release-action@61680d0e9b02ff86f5648ade99e01be17f0260a4 # v4.0.0
+      uses: cycjimmy/semantic-release-action@cb425203a562475bca039ba4dbf90c7f9ac790f4 # v4.1.0
       env:
         GITHUB_TOKEN: ${{ inputs.github-token }}
         GIT_AUTHOR_NAME: wetransform Bot