diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index 6b7d09e..a5f0f00 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -214,7 +214,7 @@ jobs:
           echo "${{ vars.CONFIG_YAML }}" > config.yaml
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6
+        uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6
         with:
           role-to-assume: arn:aws:iam::390960605471:role/eoapi-devseed
           role-session-name: eoapi-devseed
diff --git a/.github/workflows/publish-containers.yml b/.github/workflows/publish-containers.yml
index 4280fb5..4a13f60 100644
--- a/.github/workflows/publish-containers.yml
+++ b/.github/workflows/publish-containers.yml
@@ -111,7 +111,7 @@ jobs:
 
       - name: Set up QEMU
         if: steps.check.outputs.skip == 'false'
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4
+        uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4
 
       - name: Set up Docker Buildx
         if: steps.check.outputs.skip == 'false'