diff --git a/.github/workflows/compose-lint.yml b/.github/workflows/compose-lint.yml
index c56ba3a..82fb1fa 100644
--- a/.github/workflows/compose-lint.yml
+++ b/.github/workflows/compose-lint.yml
@@ -58,7 +58,7 @@ jobs:
     timeout-minutes: 15
     env:
       # renovate: datasource=node-version depName=node versioning=node
-      NODE_VERSION: "24.18.0"
+      NODE_VERSION: "24.18.1"
     outputs:
       actionlint-result: ${{ steps.results.outputs.actionlint-result }}
       lint-result: ${{ steps.results.outputs.lint-result }}
diff --git a/.github/workflows/compose-security.yml b/.github/workflows/compose-security.yml
index fe2dd27..ab64dac 100644
--- a/.github/workflows/compose-security.yml
+++ b/.github/workflows/compose-security.yml
@@ -113,7 +113,7 @@ jobs:
         id: gitguardian
         if: inputs.event-name == 'push'
         continue-on-error: true
-        uses: GitGuardian/ggshield-action@da20be06cafe5e8633dc24744efe1efe8d30f06b # v1.52.2
+        uses: GitGuardian/ggshield-action@2002482fb5990b486be5598ebcf48a8eba393fce # v1.53.0
         env:
           GITHUB_PUSH_BEFORE_SHA: ${{ inputs.github-event-before }}
           GITHUB_PUSH_BASE_SHA: ${{ inputs.github-event-base }}
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 2a85eca..ce9d2a4 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -307,7 +307,7 @@ jobs:
       # logout: false leaves the cached creds in place for downstream steps.
       - name: Login to ghcr.io
         if: steps.skip-gate.outputs.skipped == 'false'
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7  # v4.5.1
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4.6.0
         continue-on-error: true
         with:
           registry: ghcr.io
@@ -317,7 +317,7 @@ jobs:
 
       - name: Login to docker.io
         if: steps.skip-gate.outputs.skipped == 'false'
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7  # v4.5.1
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4.6.0
         continue-on-error: true
         with:
           username: ${{ steps.creds.outputs.DOCKERHUB_USERNAME }}
@@ -326,7 +326,7 @@ jobs:
 
       - name: Login to registry.gitlab.com
         if: steps.skip-gate.outputs.skipped == 'false'
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7  # v4.5.1
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4.6.0
         continue-on-error: true
         with:
           registry: registry.gitlab.com
@@ -336,7 +336,7 @@ jobs:
 
       - name: Login to gitlab-container.zenterprise.org
         if: steps.skip-gate.outputs.skipped == 'false'
-        uses: docker/login-action@abd2ef45e78c5afb21d64d4ca52ee8550d9572c7  # v4.5.1
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f  # v4.6.0
         continue-on-error: true
         with:
           registry: gitlab-container.zenterprise.org