diff --git a/.github/actions/build/build-binaries/action.yml b/.github/actions/build/build-binaries/action.yml
index cbc32e8..9864cf0 100644
--- a/.github/actions/build/build-binaries/action.yml
+++ b/.github/actions/build/build-binaries/action.yml
@@ -121,14 +121,14 @@ runs:
 
     - name: Upload artifact
       if: ${{ inputs.mainJavaBuild == 'true' }}
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
         name: binaries-${{ inputs.artifactSuffix }}.tar
         path: binaries-${{ inputs.artifactSuffix }}.tar
         retention-days: 7
 
     - name: Publish test results
-      uses: dorny/test-reporter@a43b3a5f7366b97d083190328d2c652e1a8b6aa2 # v3.0.0
+      uses: dorny/test-reporter@d1b5dff021aa968b288b02285a8bf47471c5928a # v3.2.0
       if: always() && inputs.skipTests != 'true' && inputs.clusterOperatorBuild != 'true'
       with:
         name: 'Unit & Integration tests'
diff --git a/.github/actions/build/build-containers/action.yml b/.github/actions/build/build-containers/action.yml
index ee3d80a..ccf7389 100644
--- a/.github/actions/build/build-containers/action.yml
+++ b/.github/actions/build/build-containers/action.yml
@@ -34,13 +34,13 @@ runs:
   steps:
     - name: Download binaries from this workflow
       if: ${{ inputs.buildRunId == '' }}
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
       with:
         name: binaries-${{ inputs.artifactSuffix }}.tar
 
     - name: Download binaries from external build
       if: ${{ inputs.buildRunId != '' }}
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
       with:
         name: binaries-${{ inputs.artifactSuffix }}.tar
         run-id: ${{ inputs.buildRunId }}
@@ -67,7 +67,7 @@ runs:
       run: "tar -cvpf containers-${{ inputs.artifactSuffix }}-${{ inputs.architecture }}.tar ${{ inputs.imagesLocation }}"
 
     - name: Upload containers artifact
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
         name: containers-${{ inputs.artifactSuffix }}-${{ inputs.architecture }}.tar
         path: containers-${{ inputs.artifactSuffix }}-${{ inputs.architecture }}.tar
diff --git a/.github/actions/build/publish-helm-chart/action.yml b/.github/actions/build/publish-helm-chart/action.yml
index 7c3134e..1eac5e3 100644
--- a/.github/actions/build/publish-helm-chart/action.yml
+++ b/.github/actions/build/publish-helm-chart/action.yml
@@ -34,7 +34,7 @@ runs:
   using: "composite"
   steps:
     - name: Download release artifacts
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
       with:
         name: release-${{ inputs.artifactSuffix }}-${{ inputs.releaseVersion }}.tar
         path: ./
diff --git a/.github/actions/build/push-containers/action.yml b/.github/actions/build/push-containers/action.yml
index 4f37371..3e64d6c 100644
--- a/.github/actions/build/push-containers/action.yml
+++ b/.github/actions/build/push-containers/action.yml
@@ -47,7 +47,7 @@ runs:
 
     - name: Download container artifact
       if: ${{ inputs.buildRunId != '' }}
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
       with:
         pattern: containers-${{ inputs.artifactSuffix }}*
         path: ./
@@ -57,7 +57,7 @@ runs:
 
     - name: Download container artifact
       if: ${{ inputs.buildRunId == '' }}
-      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+      uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
       with:
         pattern: containers-${{ inputs.artifactSuffix }}*
         path: ./
@@ -172,7 +172,7 @@ runs:
       # The keyless signing doesn't work on pull_requests events so this part will be tested only during push events
       # It shouldn't affect the usage in Strimzi projects as images are always pushed and signed during push or workflow_dispatch events
       if: ${{ github.event_name != 'pull_request' }}
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
         name: SBOMs-${{ inputs.artifactSuffix }}-${{ inputs.containerTag }}.tar.gz
         path: sbom.tar.gz
diff --git a/.github/actions/build/release-artifacts/action.yml b/.github/actions/build/release-artifacts/action.yml
index 9a615b5..02802e9 100644
--- a/.github/actions/build/release-artifacts/action.yml
+++ b/.github/actions/build/release-artifacts/action.yml
@@ -36,7 +36,7 @@ runs:
           -exec tar -rvf release-${{ inputs.artifactSuffix }}-${{ inputs.releaseVersion }}.tar {} \;
 
     - name: Upload release artifacts
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
         name: release-${{ inputs.artifactSuffix }}-${{ inputs.releaseVersion }}.tar
         path: release-${{ inputs.artifactSuffix }}-${{ inputs.releaseVersion }}.tar
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index eb7faec..8da2ee6 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -22,9 +22,9 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/init@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           languages: actions
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/analyze@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
diff --git a/.github/workflows/reusable-attest.yml b/.github/workflows/reusable-attest.yml
index c473b50..46d390a 100644
--- a/.github/workflows/reusable-attest.yml
+++ b/.github/workflows/reusable-attest.yml
@@ -52,7 +52,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Download release artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: release-${{ inputs.artifactSuffix }}-${{ inputs.releaseVersion }}.tar
 
@@ -64,7 +64,7 @@ jobs:
 
       - name: Download SBOMs artifact
         if: ${{ inputs.sbomsArtifact != '' }}
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ inputs.sbomsArtifact }}
 
@@ -123,7 +123,7 @@ jobs:
 
       - name: Re-upload release artifact with attestation
         if: ${{ steps.find-archives.outputs.found == 'true' }}
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: release-${{ inputs.artifactSuffix }}-${{ inputs.releaseVersion }}.tar
           path: release-${{ inputs.artifactSuffix }}-${{ inputs.releaseVersion }}.tar
@@ -169,7 +169,7 @@ jobs:
 
       - name: Download SBOMs artifact
         if: ${{ inputs.sbomsArtifact != '' && matrix.image.sbom != '' }}
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ inputs.sbomsArtifact }}
 
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index c22456c..ec8228c 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -49,7 +49,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: SARIF file
           path: results.sarif
@@ -58,6 +58,6 @@ jobs:
       # Upload the results to GitHub's code scanning dashboard (optional).
       # Commenting out will disable upload of results to your repo's Code Scanning dashboard
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
+        uses: github/codeql-action/upload-sarif@24c54180a607b1449ed407dd24f251e4e9147c8d # v4.38.3
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/test-fossa.yml b/.github/workflows/test-fossa.yml
index a557d94..9645624 100644
--- a/.github/workflows/test-fossa.yml
+++ b/.github/workflows/test-fossa.yml
@@ -160,7 +160,7 @@ jobs:
         uses: ./.github/actions/dependencies/install-docker
 
       - name: Download container archive
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: containers-drain-cleaner-amd64.tar
           run-id: ${{ needs.wait-for-container-artifact.outputs.run-id }}
diff --git a/.github/workflows/test-snyk.yml b/.github/workflows/test-snyk.yml
index 57c32b3..ebd1cc0 100644
--- a/.github/workflows/test-snyk.yml
+++ b/.github/workflows/test-snyk.yml
@@ -67,7 +67,7 @@ jobs:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
 
       - name: Download SARIF artifact
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: snyk-maven-test-drain-cleaner.sarif
           path: sarif-output
@@ -189,7 +189,7 @@ jobs:
         uses: ./.github/actions/dependencies/install-docker
 
       - name: Download container archive
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: containers-operators-amd64.tar
           run-id: ${{ needs.wait-for-container-artifact.outputs.run-id }}
@@ -238,7 +238,7 @@ jobs:
         uses: ./.github/actions/dependencies/install-docker
 
       - name: Download container archive
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: containers-drain-cleaner-amd64.tar
           run-id: ${{ needs.wait-for-container-artifact.outputs.run-id }}