diff --git a/.github/workflows/golangci-lint.yaml b/.github/workflows/golangci-lint.yaml
index 4847148..0b7bbb4 100644
--- a/.github/workflows/golangci-lint.yaml
+++ b/.github/workflows/golangci-lint.yaml
@@ -21,7 +21,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         with:
           go-version: '1.24'
           check-latest: true
diff --git a/.github/workflows/oscal-check.yaml b/.github/workflows/oscal-check.yaml
index 31d06c2..e3d2a60 100644
--- a/.github/workflows/oscal-check.yaml
+++ b/.github/workflows/oscal-check.yaml
@@ -29,7 +29,7 @@ jobs:
             path: .build/go-oscal/
             persist-credentials: false
 
-      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6.3.0
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
         name: setup-go
         with:
           go-version: '1.24'
diff --git a/.github/workflows/spellcheck.yml b/.github/workflows/spellcheck.yml
index 1abfe4a..6bbf1c2 100644
--- a/.github/workflows/spellcheck.yml
+++ b/.github/workflows/spellcheck.yml
@@ -16,6 +16,6 @@ jobs:
                 persist-credentials: false
     
           - name: Spellcheck all content
-            uses: streetsidesoftware/cspell-action@9cd41bb518a24fefdafd9880cbab8f0ceba04d28 # v8.3.0
+            uses: streetsidesoftware/cspell-action@de2a73e963e7443969755b648a1008f77033c5b2 # v8.4.0
             with:
               config: .cspell.yaml       
\ No newline at end of file