diff --git a/.github/workflows/infection.yml b/.github/workflows/infection.yml
index 82a7a90..d0092e4 100644
--- a/.github/workflows/infection.yml
+++ b/.github/workflows/infection.yml
@@ -20,7 +20,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: '8.3'
           coverage: xdebug
diff --git a/.github/workflows/phar.yml b/.github/workflows/phar.yml
index bb01b2b..abc7057 100644
--- a/.github/workflows/phar.yml
+++ b/.github/workflows/phar.yml
@@ -20,7 +20,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: '8.3'
           coverage: none
diff --git a/.github/workflows/php-quality.yml b/.github/workflows/php-quality.yml
index 75efa5d..8fa3dbd 100644
--- a/.github/workflows/php-quality.yml
+++ b/.github/workflows/php-quality.yml
@@ -24,7 +24,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: '8.3'
           coverage: none
diff --git a/.github/workflows/phpunit.yml b/.github/workflows/phpunit.yml
index a1cd138..976df25 100644
--- a/.github/workflows/phpunit.yml
+++ b/.github/workflows/phpunit.yml
@@ -22,7 +22,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: ${{ matrix.php }}
           coverage: none
@@ -37,7 +37,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         with:
           php-version: '8.5'
           coverage: none
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 27f366a..4b6cca0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -88,7 +88,7 @@ jobs:
           PUBLISHED_TAG: ${{ steps.release.outputs.tag }}
         run: echo "Release ${PUBLISHED_TAG} is already published; nothing to do."
 
-      - uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
+      - uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # 2.40.0
         if: steps.release.outputs.published != 'true'
         with:
           php-version: '8.3'
diff --git a/actions/post-merge/action.yml b/actions/post-merge/action.yml
index bcfae3d..0d19b44 100644
--- a/actions/post-merge/action.yml
+++ b/actions/post-merge/action.yml
@@ -161,7 +161,7 @@ runs:
 
     - id: finalization-token
       name: Create finalization token
-      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
       with:
         client-id: ${{ steps.app-identity.outputs.client-id }}
         private-key: ${{ inputs.app-private-key }}
@@ -244,7 +244,7 @@ runs:
     - id: draft-token
       name: Create release draft token
       if: inputs.use-caller-token-for-draft != 'true'
-      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
       with:
         client-id: ${{ steps.app-identity.outputs.client-id }}
         private-key: ${{ inputs.app-private-key }}
@@ -292,7 +292,7 @@ runs:
         } >> "${GITHUB_STEP_SUMMARY}"
 
     - name: Persist finalized release contracts
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
         name: ${{ steps.draft.outputs.state-artifact-name }}
         path: ${{ runner.temp }}/release-post-merge-state
diff --git a/actions/prepare/action.yml b/actions/prepare/action.yml
index d21f206..6b75076 100644
--- a/actions/prepare/action.yml
+++ b/actions/prepare/action.yml
@@ -219,7 +219,7 @@ runs:
 
     - id: app-token
       name: Create scoped GitHub App token
-      uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+      uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
       with:
         client-id: ${{ steps.app-identity.outputs.client-id }}
         private-key: ${{ inputs.app-private-key }}
@@ -288,7 +288,7 @@ runs:
         printf '%s' "${payload}" | gh api --method PATCH "repos/${RELEASE_REPOSITORY}/issues/${RELEASE_PR_NUMBER}" --input - >/dev/null
 
     - name: Persist release preparation contracts
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
         name: ${{ steps.prepare.outputs.artifact-name }}
         path: ${{ steps.prepare.outputs.state-dir }}
diff --git a/actions/publication/action.yml b/actions/publication/action.yml
index fe42f0d..9b0f4b7 100644
--- a/actions/publication/action.yml
+++ b/actions/publication/action.yml
@@ -148,7 +148,7 @@ runs:
         } >> "${GITHUB_STEP_SUMMARY}"
 
     - name: Persist publication verification
-      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
         name: ${{ steps.verify.outputs.verification-artifact-name }}
         path: ${{ runner.temp }}/release-publication-state