diff --git a/.github/workflows/bump-pylock.yml b/.github/workflows/bump-pylock.yml
index 5c89096..430bd52 100644
--- a/.github/workflows/bump-pylock.yml
+++ b/.github/workflows/bump-pylock.yml
@@ -21,7 +21,7 @@ jobs:
         token: ${{ secrets.MY_GITHUB_TOKEN }}
 
     - name: Install uv
-      uses: astral-sh/setup-uv@d9e0f98d3fc6adb07d1e3d37f3043649ddad06a1 # v6.5.0
+      uses: astral-sh/setup-uv@4959332f0f014c5280e7eac8b70c90cb574c9f9b # v6.6.0
       with:
         working-directory: tools
         activate-environment: true
diff --git a/.github/workflows/pymarkdownlnt.yml b/.github/workflows/pymarkdownlnt.yml
index 5a93827..3c5ab7e 100644
--- a/.github/workflows/pymarkdownlnt.yml
+++ b/.github/workflows/pymarkdownlnt.yml
@@ -21,7 +21,7 @@ jobs:
       - name: checkout repo content
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Install uv
-        uses: astral-sh/setup-uv@d9e0f98d3fc6adb07d1e3d37f3043649ddad06a1 # v6.5.0
+        uses: astral-sh/setup-uv@4959332f0f014c5280e7eac8b70c90cb574c9f9b # v6.6.0
         with:
           working-directory: tools
           activate-environment: true
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index c17ef00..5673c74 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -67,6 +67,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@96f518a34f7a870018057716cc4d7a5c014bd61c # v3.29.10
+        uses: github/codeql-action/upload-sarif@3c3833e0f8c1c83d449a7478aa59c036a9165498 # v3.29.11
         with:
           sarif_file: results.sarif