diff --git a/.github/workflows/run-zizmor.yml b/.github/workflows/run-zizmor.yml
index c71462ac4..d212dba49 100644
--- a/.github/workflows/run-zizmor.yml
+++ b/.github/workflows/run-zizmor.yml
@@ -28,6 +28,6 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor 🌈
-        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
+        uses: zizmorcore/zizmor-action@70fb788f84895a7701f5643d103d587e460b5c99 # v0.6.3
         with:
           persona: pedantic
diff --git a/.github/workflows/version_bump.yml b/.github/workflows/version_bump.yml
index ae98b4fe7..e725b1dd4 100644
--- a/.github/workflows/version_bump.yml
+++ b/.github/workflows/version_bump.yml
@@ -80,7 +80,7 @@ jobs:
     - name: Draft Release
       if: ${{ github.event.inputs.dry_run == 'false' }}
       id: draft-release
-      uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
+      uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
       with:
         draft: true
         body_path: _changelog_fragment.md