diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 4cd213576..a5d9f80fa 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -41,7 +41,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed # v2.22.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 7be29ef0f..c059073fc 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed # v2.22.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index f6bdd3dce..18dff5049 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: 'ubuntu-latest'
     steps:
       - name: 'Harden the runner (Audit all outbound calls)'
-        uses: 'step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1' # v2.21.1
+        uses: 'step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed' # v2.22.0
         with:
           egress-policy: 'audit'
 
@@ -53,7 +53,7 @@ jobs:
       url: '${{ steps.deployment.outputs.page_url }}'
     steps:
       - name: 'Harden the runner (Audit all outbound calls)'
-        uses: 'step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1' # v2.21.1
+        uses: 'step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed' # v2.22.0
         with:
           egress-policy: 'audit'
 
diff --git a/.github/workflows/lf-build-linux-aarch64.yml b/.github/workflows/lf-build-linux-aarch64.yml
index af0aba7e6..6a2e719c9 100644
--- a/.github/workflows/lf-build-linux-aarch64.yml
+++ b/.github/workflows/lf-build-linux-aarch64.yml
@@ -29,7 +29,7 @@ jobs:
       # Transform the space‐separated string into a valid JSON array using shell commands (with sed),
       # then pass that result as an output to be used in the matrix of a subsequent job.
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed # v2.22.0
         with:
           egress-policy: audit
 
@@ -56,7 +56,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed # v2.22.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/lf-build-linux-x86_64.yml b/.github/workflows/lf-build-linux-x86_64.yml
index 0155110cd..4326caa77 100644
--- a/.github/workflows/lf-build-linux-x86_64.yml
+++ b/.github/workflows/lf-build-linux-x86_64.yml
@@ -29,7 +29,7 @@ jobs:
       # Transform the space‐separated string into a valid JSON array using shell commands (with sed),
       # then pass that result as an output to be used in the matrix of a subsequent job.
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed # v2.22.0
         with:
           egress-policy: audit
 
@@ -56,7 +56,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed # v2.22.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/lf-build-windows-x86_64.yml b/.github/workflows/lf-build-windows-x86_64.yml
index d96068f63..ad3db06c2 100644
--- a/.github/workflows/lf-build-windows-x86_64.yml
+++ b/.github/workflows/lf-build-windows-x86_64.yml
@@ -32,7 +32,7 @@ jobs:
       - 'windows-2025'  # https://github.com/actions/runner-images/blob/main/images/windows/Windows2025-Readme.md
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed # v2.22.0
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/lf-unit-tests.yml b/.github/workflows/lf-unit-tests.yml
index 376fa53b8..6bc5447f1 100644
--- a/.github/workflows/lf-unit-tests.yml
+++ b/.github/workflows/lf-unit-tests.yml
@@ -50,7 +50,7 @@ jobs:
           - '3.14'
     steps:
       - name: 'Harden the runner (Audit all outbound calls)'
-        uses: 'step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1' # v2.21.1
+        uses: 'step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed' # v2.22.0
         with:
           egress-policy: 'audit'
 
@@ -96,7 +96,7 @@ jobs:
     runs-on: 'ubuntu-latest'
     steps:
       - name: 'Harden the runner (Audit all outbound calls)'
-        uses: 'step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1' # v2.21.1
+        uses: 'step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed' # v2.22.0
         with:
           egress-policy: 'audit'
 
@@ -139,7 +139,7 @@ jobs:
     runs-on: 'windows-latest'
     steps:
       - name: 'Harden the runner (Audit all outbound calls)'
-        uses: 'step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1' # v2.21.1
+        uses: 'step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed' # v2.22.0
         with:
           egress-policy: 'audit'
 
@@ -197,7 +197,7 @@ jobs:
     timeout-minutes: 330
     steps:
       - name: 'Harden the runner (Audit all outbound calls)'
-        uses: 'step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1' # v2.21.1
+        uses: 'step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed' # v2.22.0
         with:
           egress-policy: 'audit'
 
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index ba348c9c4..1de9b30ef 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -31,7 +31,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed # v2.22.0
         with:
           egress-policy: audit