diff --git a/.github/workflows/daily-master-tag.yaml b/.github/workflows/daily-master-tag.yaml
index c26bc81a9..1080c452a 100644
--- a/.github/workflows/daily-master-tag.yaml
+++ b/.github/workflows/daily-master-tag.yaml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Get Rancher App secrets
-        uses: rancher-eio/read-vault-secrets@7282bf97898cd1c16c89f837e0bb442e6d384c89 # main
+        uses: rancher-eio/read-vault-secrets@dfae8acd43a9e170fca5f90168da22f814fe4e9a # main
         with:
           secrets: |
             secret/data/github/org/rancher/github/renovate-rancher appId      | APP_ID ;
@@ -33,7 +33,7 @@ jobs:
           repositories: rancher
           permission-actions: write
       - name: Checkout master and tags
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           # using EIO app token so we can trigger release workflow if a new tag gets pushed
           token: ${{ steps.rancher-app-token.outputs.token }}
diff --git a/.github/workflows/fossa.yaml b/.github/workflows/fossa.yaml
index 7e8f169bb..a96c79505 100644
--- a/.github/workflows/fossa.yaml
+++ b/.github/workflows/fossa.yaml
@@ -15,16 +15,16 @@ jobs:
       id-token: write # needed for the Vault authentication
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Read FOSSA token
-        uses: rancher-eio/read-vault-secrets@7282bf97898cd1c16c89f837e0bb442e6d384c89 # main
+        uses: rancher-eio/read-vault-secrets@dfae8acd43a9e170fca5f90168da22f814fe4e9a # main
         with:
           secrets: |
             secret/data/github/org/rancher/fossa/push token | FOSSA_API_KEY_PUSH_ONLY
 
       - name: FOSSA scan
-        uses: fossas/fossa-action@29693cc50323968e039056be419b32989fc5880c # main
+        uses: fossas/fossa-action@9a905957066416b898a01aafe37403f483d6ab94 # main
         with:
           api-key: ${{ env.FOSSA_API_KEY_PUSH_ONLY }}
           run-tests: false
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 04699eba3..837480a0e 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -26,11 +26,11 @@ jobs:
         arch: [amd64, arm64]
     steps:
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4
       - name: Build binary
         run: make build ARCH=${{ matrix.arch }}
       - name: Package artifacts
@@ -51,7 +51,7 @@ jobs:
       id-token: write # required for cosign signing
     steps:
       - name: Load Secrets from Vault
-        uses: rancher-eio/read-vault-secrets@7282bf97898cd1c16c89f837e0bb442e6d384c89 # main
+        uses: rancher-eio/read-vault-secrets@dfae8acd43a9e170fca5f90168da22f814fe4e9a # main
         with:
           secrets: |
             secret/data/github/repo/${{ github.repository }}/dockerhub/rancher/credentials username | DOCKER_USERNAME ;
@@ -63,9 +63,9 @@ jobs:
             secret/data/github/repo/${{ github.repository }}/rancher-prime-stg-registry/credentials username | PRIME_STG_REGISTRY_USERNAME ;
             secret/data/github/repo/${{ github.repository }}/rancher-prime-stg-registry/credentials password | PRIME_STG_REGISTRY_PASSWORD
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Build and push image to DockerHub and Prime Staging Registry
-        uses: rancher/ecm-distro-tools/actions/publish-image@ba6da4535406f3fd814a169a325b8100cd4dbf44 # master
+        uses: rancher/ecm-distro-tools/actions/publish-image@09ec021bb49c607e4943745cf06a1345e8890c0a # master
         with:
           image: machine
           tag: ${{ github.ref_name }}
@@ -84,7 +84,7 @@ jobs:
           prime-password: ${{ env.PRIME_STG_REGISTRY_PASSWORD }}
       - name: Build and push image to Prime Prod Registry
         if: ${{ !contains(github.ref_name, '-rc') }}
-        uses: rancher/ecm-distro-tools/actions/publish-image@ba6da4535406f3fd814a169a325b8100cd4dbf44 # master
+        uses: rancher/ecm-distro-tools/actions/publish-image@09ec021bb49c607e4943745cf06a1345e8890c0a # master
         with:
           image: machine
           tag: ${{ github.ref_name }}
@@ -134,7 +134,7 @@ jobs:
       id-token: write
     steps:
       - name: Get Rancher App secrets
-        uses: rancher-eio/read-vault-secrets@7282bf97898cd1c16c89f837e0bb442e6d384c89 # main
+        uses: rancher-eio/read-vault-secrets@dfae8acd43a9e170fca5f90168da22f814fe4e9a # main
         with:
           secrets: |
             secret/data/github/org/rancher/github/renovate-rancher appId      | APP_ID ;
diff --git a/.github/workflows/renovate-vault.yml b/.github/workflows/renovate-vault.yml
index 49376720f..245f6cb79 100644
--- a/.github/workflows/renovate-vault.yml
+++ b/.github/workflows/renovate-vault.yml
@@ -46,7 +46,7 @@ permissions:
 
 jobs:
   call-workflow:
-    uses: rancher/renovate-config/.github/workflows/renovate-vault.yml@922c8e762a46f551a064c44539923a3216b245be # v1.0.5
+    uses: rancher/renovate-config/.github/workflows/renovate-vault.yml@faa051782ecc7002d78b37640974fa6aaf412c53 # v1.0.6
     with:
       configMigration: ${{ inputs.configMigration || 'true' }}
       logLevel: ${{ inputs.logLevel || 'info' }}
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index a85869d75..70b38b95e 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -13,9 +13,9 @@ jobs:
       contents: read
     steps:
       - name: Checkout code
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Setup Go
-        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: 'go.mod'
       - name: Run tests