diff --git a/.github/workflows/build-and-push.yaml b/.github/workflows/build-and-push.yaml
index b0956f6..628f0eb 100644
--- a/.github/workflows/build-and-push.yaml
+++ b/.github/workflows/build-and-push.yaml
@@ -165,7 +165,7 @@ jobs:
 
       - name: Docker Scout CVE scan
         if: github.ref == 'refs/heads/master' || github.ref == 'refs/heads/main'
-        uses: docker/scout-action@bacf462e8d090c09660de30a6ccc718035f961e3 # v1.20.4
+        uses: docker/scout-action@cd72f264beff1cd72735de31148b9d3244a0234a # v1.21.0
         continue-on-error: true
         with:
           command: cves
diff --git a/.github/workflows/security-scan.yaml b/.github/workflows/security-scan.yaml
index 0fabf51..49ffbed 100644
--- a/.github/workflows/security-scan.yaml
+++ b/.github/workflows/security-scan.yaml
@@ -31,7 +31,7 @@ jobs:
           output: 'trivy-results.sarif'
 
       - name: Upload Trivy results to GitHub Security
-        uses: github/codeql-action/upload-sarif@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
+        uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
         if: always()
         with:
           sarif_file: 'trivy-results.sarif'