diff --git a/.github/workflows/auto-merge.yml b/.github/workflows/auto-merge.yml
index 1091b13..14c288d 100644
--- a/.github/workflows/auto-merge.yml
+++ b/.github/workflows/auto-merge.yml
@@ -81,7 +81,7 @@ jobs:
         run: gh pr review --approve "$PR_URL"
       -
         name: Wait for all workflow runs to complete
-        uses: go-openapi/gh-actions/ci-jobs/wait-pending-jobs@6c7952706aa7afa9141262485767d9270ef5b00b # v1.3.0
+        uses: go-openapi/gh-actions/ci-jobs/wait-pending-jobs@eb161ed408645b24aaf6120cd5e4a893cf2c0af2 # v1.3.1
         with:
           pr-url: ${{ env.PR_URL }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/bump-release.yml b/.github/workflows/bump-release.yml
index 84c4a35..c51ea07 100644
--- a/.github/workflows/bump-release.yml
+++ b/.github/workflows/bump-release.yml
@@ -101,7 +101,7 @@ jobs:
           fetch-depth: 0
       -
         name: install svu
-        uses: go-openapi/gh-actions/install/svu@6c7952706aa7afa9141262485767d9270ef5b00b # v1.3.0
+        uses: go-openapi/gh-actions/install/svu@eb161ed408645b24aaf6120cd5e4a893cf2c0af2 # v1.3.1
       -
         name: Bump release
         id: bump-release
@@ -129,7 +129,7 @@ jobs:
       -
         name: Configure bot credentials
         if: ${{ inputs.enable-tag-signing == 'true' }}
-        uses: go-openapi/gh-actions/ci-jobs/bot-credentials@6c7952706aa7afa9141262485767d9270ef5b00b # v1.3.0
+        uses: go-openapi/gh-actions/ci-jobs/bot-credentials@eb161ed408645b24aaf6120cd5e4a893cf2c0af2 # v1.3.1
         # This is using the GPG signature of bot-go-openapi.
         #
         # For go-openapi repos (using secrets: inherit):
diff --git a/.github/workflows/collect-reports.yml b/.github/workflows/collect-reports.yml
index 591ca49..56b62db 100644
--- a/.github/workflows/collect-reports.yml
+++ b/.github/workflows/collect-reports.yml
@@ -32,7 +32,7 @@ jobs:
           path: reports/
       -
         name: Install go-junit-report
-        uses: go-openapi/gh-actions/install/go-junit-report@6c7952706aa7afa9141262485767d9270ef5b00b # v1.3.0
+        uses: go-openapi/gh-actions/install/go-junit-report@eb161ed408645b24aaf6120cd5e4a893cf2c0af2 # v1.3.1
       -
         name: Convert test reports to a merged JUnit XML
         # NOTE: codecov test reports only support JUnit format at this moment. See https://docs.codecov.com/docs/test-analytics.
@@ -57,7 +57,7 @@ jobs:
           verbose: true
       -
         name: Install go-ctrf-json-reporter
-        uses: go-openapi/gh-actions/install/go-ctrf-json-reporter@6c7952706aa7afa9141262485767d9270ef5b00b # v1.3.0
+        uses: go-openapi/gh-actions/install/go-ctrf-json-reporter@eb161ed408645b24aaf6120cd5e4a893cf2c0af2 # v1.3.1
       -
         name: Convert test reports to CTRF JSON
         # description: |
diff --git a/.github/workflows/contributors.yml b/.github/workflows/contributors.yml
index 49b4072..ec574a1 100644
--- a/.github/workflows/contributors.yml
+++ b/.github/workflows/contributors.yml
@@ -71,7 +71,7 @@ jobs:
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       -
         name: Identify all-time contributors to this repository
-        uses: github/contributors@e345de71bbd056a34a70709afd4f4bf0a270cc1a # v1.7.7
+        uses: github/contributors@0d5adc3833e89ee1f4145744f5d69313cf5ea238 # v1.7.8
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           REPOSITORY:  ${{ github.repository }}
@@ -83,7 +83,7 @@ jobs:
           mv contributors.md CONTRIBUTORS.md
       -
         name: Configure bot credentials
-        uses: go-openapi/gh-actions/ci-jobs/bot-credentials@6c7952706aa7afa9141262485767d9270ef5b00b # v1.3.0
+        uses: go-openapi/gh-actions/ci-jobs/bot-credentials@eb161ed408645b24aaf6120cd5e4a893cf2c0af2 # v1.3.1
         id: bot-credentials
         # For go-openapi repos (using secrets: inherit):
         #   Falls back to: CI_BOT_APP_ID, CI_BOT_APP_PRIVATE_KEY, CI_BOT_GPG_PRIVATE_KEY, etc.
@@ -141,7 +141,7 @@ jobs:
         run: gh pr review --approve "$PR_URL"
       -
         name: Wait for all workflow runs to complete
-        uses: go-openapi/gh-actions/ci-jobs/wait-pending-jobs@6c7952706aa7afa9141262485767d9270ef5b00b # v1.3.0
+        uses: go-openapi/gh-actions/ci-jobs/wait-pending-jobs@eb161ed408645b24aaf6120cd5e4a893cf2c0af2 # v1.3.1
         with:
           pr-url: ${{ env.PR_URL }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/go-test-monorepo.yml b/.github/workflows/go-test-monorepo.yml
index b393aca..5644361 100644
--- a/.github/workflows/go-test-monorepo.yml
+++ b/.github/workflows/go-test-monorepo.yml
@@ -110,7 +110,7 @@ jobs:
           echo "::notice title=go minor version::${go_minor_version}"
       -
         name: Install gotestsum
-        uses: go-openapi/gh-actions/install/gotestsum@6c7952706aa7afa9141262485767d9270ef5b00b # v1.3.0
+        uses: go-openapi/gh-actions/install/gotestsum@eb161ed408645b24aaf6120cd5e4a893cf2c0af2 # v1.3.1
       -
         name: Run unit tests on all modules in this repo (go1.25+ with go.work)
         if: ${{ needs.lint.outputs.is_monorepo == 'true' && steps.detect-test-work.outputs.supported == 'true' }}
diff --git a/.github/workflows/go-test.yml b/.github/workflows/go-test.yml
index 1ed30a3..ffcc69b 100644
--- a/.github/workflows/go-test.yml
+++ b/.github/workflows/go-test.yml
@@ -53,7 +53,7 @@ jobs:
           cache: true
       -
         name: Install gotestsum
-        uses: go-openapi/gh-actions/install/gotestsum@6c7952706aa7afa9141262485767d9270ef5b00b # v1.3.0
+        uses: go-openapi/gh-actions/install/gotestsum@eb161ed408645b24aaf6120cd5e4a893cf2c0af2 # v1.3.1
       -
         name: Run unit tests
         run: >