diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 36eedad61..782625d37 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -21,7 +21,7 @@ jobs:
     name: Validate WIT
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
         id: changes
diff --git a/.github/workflows/lint-gh.yml b/.github/workflows/lint-gh.yml
index cfd493330..e5f0ab14c 100644
--- a/.github/workflows/lint-gh.yml
+++ b/.github/workflows/lint-gh.yml
@@ -17,5 +17,5 @@ jobs:
     name: Lint GitHub Actions
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
-      - uses: rhysd/actionlint@a443f344ff32813837fa49f7aa6cbc478d770e62 # v1.7.9
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: rhysd/actionlint@0933c147c9d6587653d45fdcb4c497c57a65f9af # v1.7.10
diff --git a/.github/workflows/publish-proposal.yml b/.github/workflows/publish-proposal.yml
index fd4a815f3..fb40a27a1 100644
--- a/.github/workflows/publish-proposal.yml
+++ b/.github/workflows/publish-proposal.yml
@@ -38,10 +38,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Install cargo-binstall
-        uses: cargo-bins/cargo-binstall@3fc81674af4165a753833a94cae9f91d8849049f # v1.16.2
+        uses: cargo-bins/cargo-binstall@80aaafe04903087c333980fa2686259ddd34b2d9 # v1.16.6
 
       - name: Install wkg
         shell: bash
@@ -74,7 +74,7 @@ jobs:
           licenses: 'Apache-2.0 WITH LLVM-exception'
 
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@977bb373ede98d70efdf65b84cb5f73e068dcc2a # v3.0.0
+        uses: actions/attest-build-provenance@00014ed6ed5efc5b1ab7f7f34a39eb55d41aa4f8 # v3.1.0
         with:
           subject-name: ghcr.io/webassembly/wasi/${{ inputs.proposal }}
           subject-digest: ${{ steps.publish.outputs.digest }}
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 36117f261..391fab73d 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -207,7 +207,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Create specification directory
         run: |
@@ -244,7 +244,7 @@ jobs:
           sed -i 's/^          //' "$SPEC_DIR/Overview.md"
 
       - name: Create Pull Request for specification
-        uses: peter-evans/create-pull-request@84ae59a2cdc2258d6fa0732dd66352dddae2a412 # v7.0.9
+        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
         with:
           commit-message: "Add specification for v${{ needs.setup.outputs.version }}"
           branch: spec-v${{ needs.setup.outputs.version }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 48ffaad7b..894a4116c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -45,7 +45,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Determine versions
         id: versions
@@ -101,7 +101,7 @@ jobs:
       PROPOSALS: ${{ inputs.release_type == 'patch' && 'io random clocks filesystem sockets cli http' || 'random clocks filesystem sockets cli http' }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: Install tools
         uses: ./.github/actions/install-tools
@@ -173,7 +173,7 @@ jobs:
           done
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@84ae59a2cdc2258d6fa0732dd66352dddae2a412 # v7.0.9
+        uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 # v8.0.0
         with:
           commit-message: "Release WASI v${{ needs.prepare-release.outputs.next_version }}"
           branch: release-v${{ needs.prepare-release.outputs.next_version }}