diff --git a/.github/actions/signpath-sign/action.yml b/.github/actions/signpath-sign/action.yml
index d3b3677..37b830f 100644
--- a/.github/actions/signpath-sign/action.yml
+++ b/.github/actions/signpath-sign/action.yml
@@ -81,7 +81,7 @@ runs:
     - name: Upload unsigned artifact
       id: upload-unsigned
       if: ${{ inputs.mode != 'sanity' }}
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
         name: ${{ inputs.artifact-name }}
         path: ${{ inputs.path }}
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index ad289aa..0117364 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -47,7 +47,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4.38.2
+      uses: github/codeql-action/init@v4.38.3
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -75,6 +75,6 @@ jobs:
         make
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4.38.2
+      uses: github/codeql-action/analyze@v4.38.3
       with:
         category: "/language:${{matrix.language}}"