diff --git a/.github/workflows/call-github2gerrit.yaml b/.github/workflows/call-github2gerrit.yaml
index 2dbf20b0991..4eb6747cd0c 100644
--- a/.github/workflows/call-github2gerrit.yaml
+++ b/.github/workflows/call-github2gerrit.yaml
@@ -33,7 +33,7 @@ jobs:
     steps:
       - name: Convert GitHub PR to Gerrit Change
         # yamllint disable-line rule:line-length
-        uses: lfreleng-actions/github2gerrit-action@df12d7f11e4765687efefd034d10116b1d8d0f4d # v2.4.0
+        uses: lfreleng-actions/github2gerrit-action@6cdadc0d954315c37bbe50cf0edac88eb01df041 # v2.4.2
         with:
           GERRIT_SSH_PRIVKEY_G2G: ${{ secrets.GERRIT_SSH_PRIVKEY_G2G }}
           GERRIT_KNOWN_HOSTS: ${{ vars.GERRIT_KNOWN_HOSTS }}
diff --git a/.github/workflows/gerrit-sonar.yaml b/.github/workflows/gerrit-sonar.yaml
index f9acbff0945..94ee9378562 100644
--- a/.github/workflows/gerrit-sonar.yaml
+++ b/.github/workflows/gerrit-sonar.yaml
@@ -60,7 +60,7 @@ jobs:
     permissions:
       contents: read
     # yamllint disable-line rule:line-length
-    uses: lfreleng-actions/security-workflows/.github/workflows/sonarqube-cloud.yaml@76ea52302203912c2ced87702681da58b447d62e # v0.9.0
+    uses: lfreleng-actions/security-workflows/.github/workflows/sonarqube-cloud.yaml@4da5165382f8ca9b5ef0270caa343be4a63493d5 # v0.9.2
     with:
       # Gerrit dispatches carry a refspec and check out the change;
       # the weekly schedule leaves it empty and takes the branch.