diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index f3a228f1d..a2b66c6c9 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -35,7 +35,7 @@ jobs:
           vcpkgJsonGlob: '**/src/openvpn/contrib/vcpkg-manifests/windows/vcpkg.json'
 
       - name: Get latest CMake and ninja
-        uses: lukka/get-cmake@983956e4a5edce90f0dfcc38c1543077e668402b # v3.30.0
+        uses: lukka/get-cmake@34181361be075620f7c3871daa1cadb92d9a903e # v3.30.1
 
       - name: Install rst2html
         run: python -m pip install --upgrade pip docutils
@@ -156,7 +156,7 @@ jobs:
         run: knock -d 500 ${{ secrets.MSI_UPLOAD_REMOTE_HOST }} ${{ secrets.MSI_UPLOAD_REMOTE_KNOCK_SEQUENCE }} ; sleep 1
 
       - name: Copy MSI to remote
-        uses: garygrossgarten/github-action-scp@8a27854bb4f124a497a67316e83783efda770119 # v0.8.0
+        uses: garygrossgarten/github-action-scp@2d32ef6b45d73b9df04aac224c0839f70d5e39d6 # 0.9.0
         with:
           local: msi
           remote: ${{ secrets.MSI_UPLOAD_REMOTE_PATH }}
diff --git a/.github/workflows/renovate.yaml b/.github/workflows/renovate.yaml
index 3faea47a5..d495e2bef 100644
--- a/.github/workflows/renovate.yaml
+++ b/.github/workflows/renovate.yaml
@@ -10,7 +10,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - name: Self-hosted Renovate
-        uses: renovatebot/github-action@042670e39b8d7335e992c3fa526ecbfbd52ef57b # v40.2.2
+        uses: renovatebot/github-action@76d49712364696a06b60e8647df46b288fff0ddc # v40.2.4
         with:
           configurationFile: .github/renovate-config.json
           token: ${{ secrets.RENOVATE_TOKEN }}