diff --git a/.github/workflows/ci-rust.yml b/.github/workflows/ci-rust.yml
index 711ff7649cf..be52250119c 100644
--- a/.github/workflows/ci-rust.yml
+++ b/.github/workflows/ci-rust.yml
@@ -102,7 +102,7 @@ jobs:
         timeout-minutes: 5
 
       # Install cargo nextest command
-      - uses: taiki-e/install-action@8efaa9bb37d22aefc9d331dfbd45e2d230acfc33 # pin v2.42.22
+      - uses: taiki-e/install-action@37129d5de13e9122cce55a7a5e7e49981cef514c # pin v2.42.26
         with:
           tool: nextest@0.9.54, wasm-pack@0.12.1, cargo-deny@0.15.0
 
@@ -254,7 +254,7 @@ jobs:
         timeout-minutes: 5
 
       # Install cargo nextest command
-      - uses: taiki-e/install-action@8efaa9bb37d22aefc9d331dfbd45e2d230acfc33 # pin v2.42.22
+      - uses: taiki-e/install-action@37129d5de13e9122cce55a7a5e7e49981cef514c # pin v2.42.26
         with:
           tool: nextest@0.9.54
 
diff --git a/.github/workflows/ci-web.yml b/.github/workflows/ci-web.yml
index dc323ef8df2..9c9eb668b37 100644
--- a/.github/workflows/ci-web.yml
+++ b/.github/workflows/ci-web.yml
@@ -123,7 +123,7 @@ jobs:
         timeout-minutes: 5
 
       # Install wasm-pack command
-      - uses: taiki-e/install-action@8efaa9bb37d22aefc9d331dfbd45e2d230acfc33 # pin v2.42.22
+      - uses: taiki-e/install-action@37129d5de13e9122cce55a7a5e7e49981cef514c # pin v2.42.26
         with:
           tool: wasm-pack@${{ env.wasm-pack-version }}
 
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index df924d7271b..53f35b71481 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -58,7 +58,7 @@ jobs:
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
         if: steps.should-run-python-analysis.outputs.run == 'true'
-        uses: github/codeql-action/init@eb055d739abdc2e8de2e5f4ba1a8b246daa779aa # pin v3.26.0
+        uses: github/codeql-action/init@429e1977040da7a23b6822b13c129cd1ba93dbb2 # pin v3.26.2
         with:
           languages: python
           setup-python-dependencies: false
@@ -87,7 +87,7 @@ jobs:
 
       - name: Perform CodeQL Analysis
         if: steps.should-run-python-analysis.outputs.run == 'true'
-        uses: github/codeql-action/analyze@eb055d739abdc2e8de2e5f4ba1a8b246daa779aa # pin v3.26.0
+        uses: github/codeql-action/analyze@429e1977040da7a23b6822b13c129cd1ba93dbb2 # pin v3.26.2
         with:
           category: /language:python
 
@@ -142,7 +142,7 @@ jobs:
   #     # Initializes the CodeQL tools for scanning.
   #     - name: Initialize CodeQL
   #       if: steps.should-run-java-analysis.outputs.run == 'true'
-  #       uses: github/codeql-action/init@eb055d739abdc2e8de2e5f4ba1a8b246daa779aa # pin v3.26.0
+  #       uses: github/codeql-action/init@429e1977040da7a23b6822b13c129cd1ba93dbb2 # pin v3.26.2
   #       with:
   #         languages: java
   #         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -154,7 +154,7 @@ jobs:
 
   #     - name: Autobuild android
   #       if: steps.should-run-java-analysis.outputs.run == 'true'
-  #       uses: github/codeql-action/autobuild@eb055d739abdc2e8de2e5f4ba1a8b246daa779aa # pin v3.26.0
+  #       uses: github/codeql-action/autobuild@429e1977040da7a23b6822b13c129cd1ba93dbb2 # pin v3.26.2
   #       with:
   #         working-directory: client/android
   #       env:
@@ -162,7 +162,7 @@ jobs:
 
   #     - name: Perform CodeQL Analysis
   #       if: steps.should-run-java-analysis.outputs.run == 'true'
-  #       uses: github/codeql-action/analyze@eb055d739abdc2e8de2e5f4ba1a8b246daa779aa # pin v3.26.0
+  #       uses: github/codeql-action/analyze@429e1977040da7a23b6822b13c129cd1ba93dbb2 # pin v3.26.2
   #       with:
   #         category: /language:java
 
@@ -191,7 +191,7 @@ jobs:
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
         if: steps.should-run-js-analysis.outputs.run == 'true'
-        uses: github/codeql-action/init@eb055d739abdc2e8de2e5f4ba1a8b246daa779aa # pin v3.26.0
+        uses: github/codeql-action/init@429e1977040da7a23b6822b13c129cd1ba93dbb2 # pin v3.26.2
         with:
           languages: typescript
 
@@ -202,12 +202,12 @@ jobs:
 
       - name: Autobuild for typescript
         if: steps.should-run-js-analysis.outputs.run == 'true'
-        uses: github/codeql-action/autobuild@eb055d739abdc2e8de2e5f4ba1a8b246daa779aa # pin v3.26.0
+        uses: github/codeql-action/autobuild@429e1977040da7a23b6822b13c129cd1ba93dbb2 # pin v3.26.2
         with:
           working-directory: client
 
       - name: Perform CodeQL Analysis
         if: steps.should-run-js-analysis.outputs.run == 'true'
-        uses: github/codeql-action/analyze@eb055d739abdc2e8de2e5f4ba1a8b246daa779aa # pin v3.26.0
+        uses: github/codeql-action/analyze@429e1977040da7a23b6822b13c129cd1ba93dbb2 # pin v3.26.2
         with:
           category: /language:typescript
diff --git a/.github/workflows/cspell.yml b/.github/workflows/cspell.yml
index 3da6ee4cf8f..59046d39640 100644
--- a/.github/workflows/cspell.yml
+++ b/.github/workflows/cspell.yml
@@ -74,7 +74,7 @@ jobs:
 
       - name: Check spelling in the repository
         id: cspell
-        uses: streetsidesoftware/cspell-action@0e63b882c2ef0e24d78b8b1fbb132b42c0a0d0cb # pin v6.8.0
+        uses: streetsidesoftware/cspell-action@934c74da3775ac844ec89503f666f67efb427fed # pin v6.8.1
         with:
           config: .cspell/cspell.config.yml
           # Only check for changed files on a PR
diff --git a/.github/workflows/docker-server.yml b/.github/workflows/docker-server.yml
index 9968adb515a..1ebb74726a6 100644
--- a/.github/workflows/docker-server.yml
+++ b/.github/workflows/docker-server.yml
@@ -64,7 +64,7 @@ jobs:
             latest=${{ github.event_name == 'push' && github.ref_type == 'tag' }}
 
       - name: Build and export to Docker
-        uses: docker/build-push-action@16ebe778df0e7752d2cfcbd924afdbbd89c1a755 # v6.6.1
+        uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6.7.0
         id: build
         with:
           context: .
@@ -96,7 +96,7 @@ jobs:
         run: echo "${{ steps.metadata.outputs.tags }}"
 
       - name: Build and publish
-        uses: docker/build-push-action@16ebe778df0e7752d2cfcbd924afdbbd89c1a755 # v6.6.1
+        uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6.7.0
         id: publish
         with:
           context: .
diff --git a/.github/workflows/docker-testbed.yml b/.github/workflows/docker-testbed.yml
index d5fa53f1fb3..8ccc96da136 100644
--- a/.github/workflows/docker-testbed.yml
+++ b/.github/workflows/docker-testbed.yml
@@ -70,7 +70,7 @@ jobs:
             latest=${{ github.event_name == 'workflow_dispatch' }}
 
       - name: Build and export to Docker
-        uses: docker/build-push-action@16ebe778df0e7752d2cfcbd924afdbbd89c1a755 # v6.6.1
+        uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6.7.0
         id: build
         with:
           context: .
@@ -103,7 +103,7 @@ jobs:
 
       - name: Build and publish
         if: github.event_name == 'workflow_dispatch'
-        uses: docker/build-push-action@16ebe778df0e7752d2cfcbd924afdbbd89c1a755 # v6.6.1
+        uses: docker/build-push-action@5cd11c3a4ced054e52742c5fd54dca954e0edd85 # v6.7.0
         with:
           context: .
           file: server/packaging/testbed-server/testbed-server.dockerfile
diff --git a/.github/workflows/package-client.yml b/.github/workflows/package-client.yml
index d5c5ef470ac..b05b306fee2 100644
--- a/.github/workflows/package-client.yml
+++ b/.github/workflows/package-client.yml
@@ -94,7 +94,7 @@ jobs:
         working-directory: client
 
       # Install syft
-      - uses: taiki-e/install-action@8efaa9bb37d22aefc9d331dfbd45e2d230acfc33 # pin v2.42.22
+      - uses: taiki-e/install-action@37129d5de13e9122cce55a7a5e7e49981cef514c # pin v2.42.26
         with:
           tool: syft@0.84.0, wasm-pack@${{ env.wasm-pack-version }}
 
@@ -194,7 +194,7 @@ jobs:
           mv -v parsec_*_*.snap Parsec_${{ steps.version.outputs.full }}_linux_$ARCH.snap
 
       # Install syft
-      - uses: taiki-e/install-action@8efaa9bb37d22aefc9d331dfbd45e2d230acfc33 # pin v2.42.22
+      - uses: taiki-e/install-action@37129d5de13e9122cce55a7a5e7e49981cef514c # pin v2.42.26
         with:
           tool: syft@0.84.0
 
@@ -335,7 +335,7 @@ jobs:
         timeout-minutes: 1
 
       # Install syft
-      - uses: taiki-e/install-action@8efaa9bb37d22aefc9d331dfbd45e2d230acfc33 # pin v2.42.22
+      - uses: taiki-e/install-action@37129d5de13e9122cce55a7a5e7e49981cef514c # pin v2.42.26
         with:
           tool: syft@0.84.0
 
diff --git a/.github/workflows/package-server.yml b/.github/workflows/package-server.yml
index eba12e1bb89..85edc3a8616 100644
--- a/.github/workflows/package-server.yml
+++ b/.github/workflows/package-server.yml
@@ -136,7 +136,7 @@ jobs:
         run: python server/packaging/wheel/wheel_it.py ./server --output dist --skip-wheel
 
       # Install syft
-      - uses: taiki-e/install-action@8efaa9bb37d22aefc9d331dfbd45e2d230acfc33 # pin v2.42.22
+      - uses: taiki-e/install-action@37129d5de13e9122cce55a7a5e7e49981cef514c # pin v2.42.26
         with:
           tool: syft@0.84.0