diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ee70596c..1023467f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -122,7 +122,7 @@ jobs:
 
       - name: Add coverage summary to PR
         if: always() && github.event_name == 'pull_request'
-        uses: marocchino/sticky-pull-request-comment@v3
+        uses: marocchino/sticky-pull-request-comment@v3.0.4
         with:
           recreate: true
           message: |
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 3a5c5370..c9294aa7 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -26,7 +26,7 @@ jobs:
           global-json-file: global.json
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.36.2
+        uses: github/codeql-action/init@v4.36.3
         with:
           languages: csharp
 
@@ -34,4 +34,4 @@ jobs:
         run: dotnet build --configuration Release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4.36.2
+        uses: github/codeql-action/analyze@v4.36.3
diff --git a/.github/workflows/containers.yml b/.github/workflows/containers.yml
index ec15c968..2496542c 100644
--- a/.github/workflows/containers.yml
+++ b/.github/workflows/containers.yml
@@ -47,7 +47,7 @@ jobs:
           echo "name=${{ env.REGISTRY }}/${owner}/jd.ai-${{ matrix.component }}" >> "$GITHUB_OUTPUT"
 
       - name: Login to GHCR
-        uses: docker/login-action@v4.2.0
+        uses: docker/login-action@v4.4.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -55,7 +55,7 @@ jobs:
 
       - name: Extract metadata
         id: meta
-        uses: docker/metadata-action@v6.1.0
+        uses: docker/metadata-action@v6.2.0
         with:
           images: ${{ steps.image.outputs.name }}
           tags: |