diff --git a/.github/workflows/cla-close-stale.yml b/.github/workflows/cla-close-stale.yml
index 8f8cd11f..98a59eee 100644
--- a/.github/workflows/cla-close-stale.yml
+++ b/.github/workflows/cla-close-stale.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Close stale unsigned-CLA PRs
-        uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 #v10.4.0
+        uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 #v11.0.0
         with:
           # ---- Guards: only act on PRs carrying the CLA label ----
           only-labels: 'awaiting cla'
diff --git a/.github/workflows/releases.yml b/.github/workflows/releases.yml
index 81e1ae1c..c4f4e458 100644
--- a/.github/workflows/releases.yml
+++ b/.github/workflows/releases.yml
@@ -77,7 +77,7 @@ jobs:
             type=semver,pattern={{version}}
 
       - name: Log in to GHCR
-        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
+        uses: docker/login-action@371161bbe7024a29a25c5e19bfcbc0804fe9ad2c # v4.5.2
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ env.REGISTRY_USER }}