diff --git a/.github/actions/build-and-persist-plugin-binary/action.yml b/.github/actions/build-and-persist-plugin-binary/action.yml
index 9a151de7..81d274bf 100644
--- a/.github/actions/build-and-persist-plugin-binary/action.yml
+++ b/.github/actions/build-and-persist-plugin-binary/action.yml
@@ -17,7 +17,7 @@ runs:
     shell: bash
   - run: rm ./pkg/packer_plugin_amazon_${{ inputs.GOOS }}_${{ inputs.GOARCH }}
     shell: bash
-  - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+  - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
     with:
       name: "packer_plugin_amazon_${{ inputs.GOOS }}_${{ inputs.GOARCH }}.zip"
       path: "pkg/packer_plugin_amazon_${{ inputs.GOOS }}_${{ inputs.GOARCH }}.zip"
diff --git a/.github/workflows/acceptance-tests.yml b/.github/workflows/acceptance-tests.yml
index bf56ea3c..3d4be6a8 100644
--- a/.github/workflows/acceptance-tests.yml
+++ b/.github/workflows/acceptance-tests.yml
@@ -26,7 +26,7 @@ jobs:
     outputs:
       go-version: ${{ steps.get-go-version.outputs.go-version }}
     steps:
-      - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
       - name: 'Determine Go version'
         id: get-go-version
         run: |
@@ -42,16 +42,16 @@ jobs:
       contents: read
     name: AWS EBS Acceptance tests
     steps:
-      - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
         with:
           ref: ${{ github.event.inputs.branch }}
-      - uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0
+      - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
           go-version: ${{ needs.get-go-version.outputs.go-version }}
       - name: "Compile/install the plugin on the current branch"
         run: |
           make dev
-      - uses: aws-actions/configure-aws-credentials@010d0da01d0b5a38af31e9c3470dbfdabdecca3a # v4.0.1
+      - uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
         with:
           aws-access-key-id: "${{ secrets.AWS_ACC_TEST_KEY_ID }}"
           aws-secret-access-key: "${{ secrets.AWS_ACC_TEST_KEY_SECRET }}"
@@ -68,7 +68,7 @@ jobs:
             ./builder/ebs
       - run: zip ebs_failure_logs.zip builder/ebs/*txt
         if: ${{ failure() }}
-      - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+      - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
         if: ${{ failure() }}
         with:
           name: "ebs_failure_logs.zip"
@@ -84,16 +84,16 @@ jobs:
       contents: read
     name: AWS EBS Surrogate Acceptance tests
     steps:
-      - uses: actions/checkout@8f4b7f84864484a7bf31766abe9204da3cbe65b3 # v3.5.0
+      - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
         with:
           ref: ${{ github.event.inputs.branch }}
-      - uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0
+      - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
           go-version: ${{ needs.get-go-version.outputs.go-version }}
       - name: "Compile/install the plugin on the current branch"
         run: |
           make dev
-      - uses: aws-actions/configure-aws-credentials@e1e17a757e536f70e52b5a12b2e8d1d1c60e04ef # v2
+      - uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502 # v4.0.2
         with:
           aws-access-key-id: "${{ secrets.AWS_ACC_TEST_KEY_ID }}"
           aws-secret-access-key: "${{ secrets.AWS_ACC_TEST_KEY_SECRET }}"
@@ -110,7 +110,7 @@ jobs:
             ./builder/ebssurrogate
       - run: zip ebssurrogate_failure_logs.zip builder/ebssurrogate/*txt
         if: ${{ failure() }}
-      - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
+      - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
         if: ${{ failure() }}
         with:
           name: "ebssurrogate_failure_logs.zip"
diff --git a/.github/workflows/go-validate.yml b/.github/workflows/go-validate.yml
index a397a133..7e67a99b 100644
--- a/.github/workflows/go-validate.yml
+++ b/.github/workflows/go-validate.yml
@@ -49,7 +49,7 @@ jobs:
       - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
           go-version: ${{ needs.get-go-version.outputs.go-version }}
-      - uses: golangci/golangci-lint-action@3cfe3a4abbb849e10058ce4af15d205b6da42804 # v4.0.0
+      - uses: golangci/golangci-lint-action@82d40c283aeb1f2b6595839195e95c2d6a49081b # v5.0.0
         with:
           version: v1.54.2
           only-new-issues: true
diff --git a/.github/workflows/jira.yml b/.github/workflows/jira.yml
index e0163a9e..9af28d32 100644
--- a/.github/workflows/jira.yml
+++ b/.github/workflows/jira.yml
@@ -67,7 +67,7 @@ jobs:
                    "labels": ${{ steps.set-ticket-labels.outputs.labels }} }'
       - name: Add tracking comment
         if: steps.create-ticket.outputs.issue != '' && steps.set-ticket-type.outputs.type != 'Invalid'
-        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           script: |
             github.rest.issues.createComment({
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c2fa221f..ec35d84b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -51,7 +51,7 @@ jobs:
       - name: Install signore
         uses: hashicorp/setup-signore-package@v1
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@f82d6c1c344bcacabba2c841718984797f664a6b # v5.0.0
+        uses: goreleaser/goreleaser-action@7ec5c2b0c6cdda6e8bbb49444bc797dd33d74dd8 # v5.0.0
         with:
           version: latest
           args: release --clean --timeout 120m