diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 54dcda4..b75db98 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -41,7 +41,7 @@ jobs:
     # skipped job would skip every job after it.
     steps:
       # The App token, not GITHUB_TOKEN, opens the release PR, so CI runs on it.
-      - uses: actions/create-github-app-token@f8d387b68d61c58ab83c6c016672934102569859 # v3.0.0
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         if: github.event_name == 'push'
         id: app-token
         with:
@@ -165,7 +165,7 @@ jobs:
           cp "target/$TARGET/release/ck" LICENSE README.md "$dir/"
           tar -czf "$dir.tar.gz" "$dir"
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ matrix.target }}
           path: ck-*.tar.gz
@@ -182,7 +182,7 @@ jobs:
       id-token: write # sign the attestation
       attestations: write # store the attestation
     steps:
-      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           path: dist
           merge-multiple: true