diff --git a/.github/workflows/issue-classifier.lock.yml b/.github/workflows/issue-classifier.lock.yml
index bbbbaa0e75..8d038aaf05 100644
--- a/.github/workflows/issue-classifier.lock.yml
+++ b/.github/workflows/issue-classifier.lock.yml
@@ -2206,7 +2206,7 @@ jobs:
           path: /tmp/gh-aw/aw_info.json
           if-no-files-found: warn
       - name: Run AI Inference
-        uses: actions/ai-inference@334892bb203895caaed82ec52d23c1ed9385151e # v2.0.4
+        uses: actions/ai-inference@334892bb203895caaed82ec52d23c1ed9385151e # v1
         env:
           GH_AW_MCP_CONFIG: /tmp/gh-aw/mcp-config/mcp-servers.json
           GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
diff --git a/.github/workflows/release.lock.yml b/.github/workflows/release.lock.yml
index da587dae86..4cdc5646f7 100644
--- a/.github/workflows/release.lock.yml
+++ b/.github/workflows/release.lock.yml
@@ -6021,13 +6021,13 @@ jobs:
       - name: Download Go modules
         run: go mod download
       - name: Generate SBOM (SPDX format)
-        uses: anchore/sbom-action@43a17d6e7add2b5535efe4dcae9952337c479a93 # v0.20.11
+        uses: anchore/sbom-action@43a17d6e7add2b5535efe4dcae9952337c479a93 # v0.20.10
         with:
           artifact-name: sbom.spdx.json
           format: spdx-json
           output-file: sbom.spdx.json
       - name: Generate SBOM (CycloneDX format)
-        uses: anchore/sbom-action@43a17d6e7add2b5535efe4dcae9952337c479a93 # v0.20.11
+        uses: anchore/sbom-action@43a17d6e7add2b5535efe4dcae9952337c479a93 # v0.20.10
         with:
           artifact-name: sbom.cdx.json
           format: cyclonedx-json
@@ -6234,7 +6234,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - name: Release with gh-extension-precompile
-        uses: cli/gh-extension-precompile@9e2237c30f869ad3bcaed6a4be2cd43564dd421b # v2.1.0
+        uses: cli/gh-extension-precompile@9e2237c30f869ad3bcaed6a4be2cd43564dd421b # v2
         with:
           build_script_override: scripts/build-release.sh
           go_version_file: go.mod
diff --git a/.github/workflows/stale-repo-identifier.lock.yml b/.github/workflows/stale-repo-identifier.lock.yml
index f1fe7c40a4..3393e02f2e 100644
--- a/.github/workflows/stale-repo-identifier.lock.yml
+++ b/.github/workflows/stale-repo-identifier.lock.yml
@@ -176,7 +176,7 @@ jobs:
           ORGANIZATION: ${{ env.ORGANIZATION }}
         id: stale-repos
         name: Run stale_repos tool
-        uses: github/stale-repos@a21e55567b83cf3c3f3f9085d3038dc6cee02598 # v3.0.2
+        uses: github/stale-repos@a21e55567b83cf3c3f3f9085d3038dc6cee02598 # v3
       - env:
           INACTIVE_REPOS: ${{ steps.stale-repos.outputs.inactiveRepos }}
         name: Save stale repos output
diff --git a/.github/workflows/super-linter.lock.yml b/.github/workflows/super-linter.lock.yml
index 129ba416e5..5824283b2c 100644
--- a/.github/workflows/super-linter.lock.yml
+++ b/.github/workflows/super-linter.lock.yml
@@ -6151,7 +6151,7 @@ jobs:
           persist-credentials: false
       - name: Super-linter
         id: super-linter
-        uses: super-linter/super-linter@47984f49b4e87383eed97890fe2dca6063bbd9c3 # v8.3.1
+        uses: super-linter/super-linter@47984f49b4e87383eed97890fe2dca6063bbd9c3 # v8.2.1
         env:
           CREATE_LOG_FILE: "true"
           DEFAULT_BRANCH: main
diff --git a/pkg/cli/compile_config.go b/pkg/cli/compile_config.go
index 922a0daee9..94e7c7de2e 100644
--- a/pkg/cli/compile_config.go
+++ b/pkg/cli/compile_config.go
@@ -71,29 +71,29 @@ var (
 
 	// Common non-sensitive workflow keywords to exclude from redaction
 	commonWorkflowKeywords = map[string]bool{
-		"GITHUB":          true,
-		"ACTIONS":         true,
-		"WORKFLOW":        true,
-		"RUNNER":          true,
-		"JOB":             true,
-		"STEP":            true,
-		"MATRIX":          true,
-		"ENV":             true,
-		"PATH":            true,
-		"HOME":            true,
-		"SHELL":           true,
-		"INPUTS":          true,
-		"OUTPUTS":         true,
-		"NEEDS":           true,
-		"STRATEGY":        true,
-		"CONCURRENCY":     true,
-		"IF":              true,
-		"WITH":            true,
-		"USES":            true,
-		"RUN":             true,
+		"GITHUB":            true,
+		"ACTIONS":           true,
+		"WORKFLOW":          true,
+		"RUNNER":            true,
+		"JOB":               true,
+		"STEP":              true,
+		"MATRIX":            true,
+		"ENV":               true,
+		"PATH":              true,
+		"HOME":              true,
+		"SHELL":             true,
+		"INPUTS":            true,
+		"OUTPUTS":           true,
+		"NEEDS":             true,
+		"STRATEGY":          true,
+		"CONCURRENCY":       true,
+		"IF":                true,
+		"WITH":              true,
+		"USES":              true,
+		"RUN":               true,
 		"WORKING_DIRECTORY": true,
 		"CONTINUE_ON_ERROR": true,
-		"TIMEOUT_MINUTES": true,
+		"TIMEOUT_MINUTES":   true,
 	}
 )