diff --git a/.github/workflows/AddIssueCommentWithLabel.yml b/.github/workflows/AddIssueCommentWithLabel.yml
index ce265852ff5..67cb7efcb6f 100644
--- a/.github/workflows/AddIssueCommentWithLabel.yml
+++ b/.github/workflows/AddIssueCommentWithLabel.yml
@@ -12,12 +12,12 @@ jobs:
     name: Comment on issue
     steps:
       - name: Checkout comment message
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           sparse-checkout: |
             .github/template/non-security-comment.md
       - name: Comment on issue with no security label
-        uses: mshick/add-pr-comment@b8f338c590a895d50bcbfa6c5859251edc8952fc # v2.8.2
+        uses: mshick/add-pr-comment@ec328af66588ab8f77cdeb2c264f14aba45bbf59 # v3.12.0
         with:
            repo-token: ${{ secrets.GITHUB_TOKEN }}
            message-id: issueNoSecurityCommentBot
diff --git a/.github/workflows/AzdevLinter.yml b/.github/workflows/AzdevLinter.yml
index 175fdf01541..c6357a170b9 100644
--- a/.github/workflows/AzdevLinter.yml
+++ b/.github/workflows/AzdevLinter.yml
@@ -15,7 +15,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout CLI repo
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           sparse-checkout: |
diff --git a/.github/workflows/AzdevStyle.yml b/.github/workflows/AzdevStyle.yml
index 6db750cd997..eded300ac0c 100644
--- a/.github/workflows/AzdevStyle.yml
+++ b/.github/workflows/AzdevStyle.yml
@@ -15,7 +15,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout CLI repo
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
           sparse-checkout: |
diff --git a/.github/workflows/BlockPRMerge.yml b/.github/workflows/BlockPRMerge.yml
index 912b8506483..3a1a72d9880 100644
--- a/.github/workflows/BlockPRMerge.yml
+++ b/.github/workflows/BlockPRMerge.yml
@@ -15,7 +15,7 @@ jobs:
     permissions: {}
     steps:
       - name: Check blocked labels
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const labels = context.payload.pull_request.labels.map(label => label.name);
diff --git a/.github/workflows/CCOA.yml b/.github/workflows/CCOA.yml
index ba2393fe45a..fa8444695e0 100644
--- a/.github/workflows/CCOA.yml
+++ b/.github/workflows/CCOA.yml
@@ -36,7 +36,7 @@ jobs:
 
       - name: Comment on PR
         if: steps.date_check.outputs.continue == 'true'
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/GitHookNotice.yml b/.github/workflows/GitHookNotice.yml
index adff1d9fb69..10182cb6a19 100644
--- a/.github/workflows/GitHookNotice.yml
+++ b/.github/workflows/GitHookNotice.yml
@@ -15,7 +15,7 @@ jobs:
     name: Introduce git hook in developer env
     steps:
       - name: Checkout git hook notice message
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           sparse-checkout: |
             .github/template/git-hooks-note.md
diff --git a/.github/workflows/TriggerReferenceDocsCI.yml b/.github/workflows/TriggerReferenceDocsCI.yml
index 8c0e35637bb..b4b49dc86b8 100644
--- a/.github/workflows/TriggerReferenceDocsCI.yml
+++ b/.github/workflows/TriggerReferenceDocsCI.yml
@@ -14,7 +14,7 @@ jobs:
     environment: docs
     steps:
     - name: Azure Login
-      uses: Azure/login@6b2456866fc08b011acb422a92a4aa20e2c4de32 # v2.1.0
+      uses: Azure/login@7ddb5af1ef8758cf1353cf3b42f940aee27ba21c # v3.0.2
       with:
         client-id: ${{ secrets.ADO_DocsReference_SP_ClientID }}
         tenant-id: ${{ secrets.ADO_DocsReference_SP_TenantID }}