diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index eb2fc0a1..a2d9a556 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -43,7 +43,7 @@ jobs:
       # -> "piston-data.mojang.com": Downloading of the Mojang server
       # -> "api.minecraftservices.com": Downloading Yggdrasil public key for Reobfuscation
       - name: Harden runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           disable-sudo: true
           egress-policy: block
diff --git a/.github/workflows/conventional-commit.yml b/.github/workflows/conventional-commit.yml
index 2bc0cef8..0bd7f562 100644
--- a/.github/workflows/conventional-commit.yml
+++ b/.github/workflows/conventional-commit.yml
@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           disable-sudo-and-containers: true
           egress-policy: block
diff --git a/.github/workflows/docs-deploy.yml b/.github/workflows/docs-deploy.yml
index b8511486..00336eb3 100644
--- a/.github/workflows/docs-deploy.yml
+++ b/.github/workflows/docs-deploy.yml
@@ -28,7 +28,7 @@ jobs:
       # -> "*.alpinelinux.org": Standard interactions with Alpine Linux package repositories
       # -> "cdn.fwupd.org": Firmware updates (Alpine)
       - name: Harden runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           disable-sudo: true
           egress-policy: block
@@ -90,7 +90,7 @@ jobs:
       # -> "*.github.com": Standard interactions with GitHub
       # -> "api.github.com": Required for GitHub Pages deployment
       - name: Harden runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           disable-sudo: true
           egress-policy: block
diff --git a/.github/workflows/docs-validate.yml b/.github/workflows/docs-validate.yml
index 213209d9..fad32374 100644
--- a/.github/workflows/docs-validate.yml
+++ b/.github/workflows/docs-validate.yml
@@ -28,7 +28,7 @@ jobs:
       # -> "*.alpinelinux.org": Standard interactions with Alpine Linux package repositories
       # -> "cdn.fwupd.org": Firmware updates (Alpine)
       - name: Harden runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           disable-sudo: true
           egress-policy: block
diff --git a/.github/workflows/openssf.yml b/.github/workflows/openssf.yml
index 87f5ba05..330217c5 100644
--- a/.github/workflows/openssf.yml
+++ b/.github/workflows/openssf.yml
@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           disable-sudo: true
           egress-policy: block
diff --git a/.github/workflows/release-dry-run.yml b/.github/workflows/release-dry-run.yml
index a7e00ba8..410bce07 100644
--- a/.github/workflows/release-dry-run.yml
+++ b/.github/workflows/release-dry-run.yml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Harden runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           disable-sudo-and-containers: true
           egress-policy: block
diff --git a/.github/workflows/release-maintenance.yml b/.github/workflows/release-maintenance.yml
index 052e4e25..427d5467 100644
--- a/.github/workflows/release-maintenance.yml
+++ b/.github/workflows/release-maintenance.yml
@@ -67,7 +67,7 @@ jobs:
       # -> "api.papermc.io": Dynamic retrieval of the PaperMC server
       # -> "api.nuget.org" & "registry.npmjs.org": Downloading semver CLI
       - name: Harden runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           disable-sudo: true
           egress-policy: block
diff --git a/.github/workflows/release-on-change.yml b/.github/workflows/release-on-change.yml
index e69e5562..1730c02b 100644
--- a/.github/workflows/release-on-change.yml
+++ b/.github/workflows/release-on-change.yml
@@ -48,7 +48,7 @@ jobs:
       # -> "api.papermc.io": Dynamic retrieval of the PaperMC server
       # -> "api.nuget.org" & "registry.npmjs.org": Downloading semantic-release CLI
       - name: Harden runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
         with:
           disable-sudo: true
           egress-policy: block