diff --git a/.github/workflows/dev.yaml b/.github/workflows/dev.yaml
index a41cf91..6053efd 100644
--- a/.github/workflows/dev.yaml
+++ b/.github/workflows/dev.yaml
@@ -91,6 +91,6 @@ jobs:
           pre-commit run --all-files --color=always --show-diff-on-failure --verbose
 
       - name: Analyze workflows with zizmor
-        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+        uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3
         with:
           advanced-security: false
diff --git a/.github/workflows/docker-build.yaml b/.github/workflows/docker-build.yaml
index d2dce7f..e5cdd62 100644
--- a/.github/workflows/docker-build.yaml
+++ b/.github/workflows/docker-build.yaml
@@ -49,7 +49,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8  # v4.2.0
+      - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a  # v4.3.0
       - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e  # v4.3.0
 
       - name: Log in to ghcr.io
diff --git a/.github/workflows/test_local.yaml b/.github/workflows/test_local.yaml
index 9d9cfeb..208c5c0 100644
--- a/.github/workflows/test_local.yaml
+++ b/.github/workflows/test_local.yaml
@@ -48,11 +48,11 @@ jobs:
           cache: false
           go-version-file: tests/make/godummy/module/go.mod
 
-      - uses: prefix-dev/setup-pixi@f00437f565399d418b0acc85936d12c1fb668347  # v0.10.1
+      - uses: prefix-dev/setup-pixi@d3f436a425481402e6a95a1d1fc10331c708cd9e  # v0.10.2
         with:
           pixi-version: v0.72.0
 
-      - uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8  # v4.2.0
+      - uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a  # v4.3.0
         if: runner.os == 'Linux'
       - uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e  # v4.3.0
         if: runner.os == 'Linux'