diff --git a/.github/workflows/asciinema.yml b/.github/workflows/asciinema.yml
index 36321b6da..f55e3aefc 100644
--- a/.github/workflows/asciinema.yml
+++ b/.github/workflows/asciinema.yml
@@ -30,7 +30,7 @@ jobs:
         uses: azure/login@a65d910e8af852a8061c627c456678983e180302 # v2.2.0
         with:
           creds: ${{ secrets.CONTRAST_CI_INFRA_AZURE }}
-      - uses: nicknovitski/nix-develop@8b263330c8f0999d6ce564372b099f00af6f8e8a # v1.1.1
+      - uses: nicknovitski/nix-develop@c2bcf9062b7c3a24659d915b8f272c1931a5802f # v1.2.0
       - name: Create justfile.env
         run: |
           cat <<EOF > justfile.env
diff --git a/.github/workflows/cleanup.yml b/.github/workflows/cleanup.yml
index 44e3c5add..2da406302 100644
--- a/.github/workflows/cleanup.yml
+++ b/.github/workflows/cleanup.yml
@@ -17,7 +17,7 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - uses: ./.github/actions/setup_nix
         with:
           githubToken: ${{ secrets.GITHUB_TOKEN }}
@@ -28,7 +28,7 @@ jobs:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      - uses: nicknovitski/nix-develop@a2060d116a50b36dfab02280af558e73ab52427d # v1.1.0
+      - uses: nicknovitski/nix-develop@c2bcf9062b7c3a24659d915b8f272c1931a5802f # v1.2.0
       - name: Create justfile.env
         run: |
           cat <<EOF > justfile.env
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index f01e3e035..0eff21189 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -49,7 +49,7 @@ jobs:
         uses: azure/login@a65d910e8af852a8061c627c456678983e180302 # v2.2.0
         with:
           creds: ${{ secrets.CONTRAST_CI_INFRA_AZURE }}
-      - uses: nicknovitski/nix-develop@8b263330c8f0999d6ce564372b099f00af6f8e8a # v1.1.1
+      - uses: nicknovitski/nix-develop@c2bcf9062b7c3a24659d915b8f272c1931a5802f # v1.2.0
       - name: Create justfile.env
         run: |
           cat <<EOF > justfile.env
diff --git a/.github/workflows/e2e_runtime-reproducibility.yml b/.github/workflows/e2e_runtime-reproducibility.yml
index 297f64957..3e973a9c7 100644
--- a/.github/workflows/e2e_runtime-reproducibility.yml
+++ b/.github/workflows/e2e_runtime-reproducibility.yml
@@ -31,7 +31,7 @@ jobs:
         with:
           githubToken: ${{ secrets.GITHUB_TOKEN }}
           cachixToken: "" # Don't use the cachix cache
-      - uses: nicknovitski/nix-develop@8b263330c8f0999d6ce564372b099f00af6f8e8a # v1.1.1
+      - uses: nicknovitski/nix-develop@c2bcf9062b7c3a24659d915b8f272c1931a5802f # v1.2.0
       - name: Build
         id: build
         run: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 69ae392a7..94b335c65 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -331,7 +331,7 @@ jobs:
             workspace/runtime-*.yml
             workspace/emojivoto-demo.yml
       - name: Create draft release
-        uses: softprops/action-gh-release@c062e08bd532815e2082a85e87e3ef29c3e6d191 # v2.0.8
+        uses: softprops/action-gh-release@e7a8f85e1c67a31e6ed99a94b41bd0b71bbee6b8 # v2.0.9
         with:
           draft: true
           generate_release_notes: true
@@ -393,7 +393,7 @@ jobs:
         with:
           creds: ${{ secrets.CONTRAST_CI_INFRA_AZURE }}
       - if: ${{ !matrix.platform.self-hosted }}
-        uses: nicknovitski/nix-develop@8b263330c8f0999d6ce564372b099f00af6f8e8a # v1.1.1
+        uses: nicknovitski/nix-develop@c2bcf9062b7c3a24659d915b8f272c1931a5802f # v1.2.0
       - name: Create justfile.env
         run: |
           cat <<EOF > justfile.env