diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml
index bbbe5a2..37c3d96 100644
--- a/.github/workflows/stale.yaml
+++ b/.github/workflows/stale.yaml
@@ -14,7 +14,7 @@ jobs:
       issues: write # Label, comment on, and close stale issues
       pull-requests: write # Label, comment on, and close stale pull requests
     steps:
-      - uses: step-security/harden-runner@ccd8616d44fd3846e67624a50d5aad6d37bf2d25 # v2.22.1
+      - uses: step-security/harden-runner@dc2769abcc0fcfbadfc1df54081c1608579ef6b2 # v2.22.2
         with:
           egress-policy: audit
 
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 9d0aaef..56aeb88 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -32,7 +32,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Audit workflows and dependabot config with zizmor
-        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482 # v0.6.4
+        uses: zizmorcore/zizmor-action@85b2b9fb8e3325e7a23d7d0a9d7ba5ae0f999e3e # v0.7.1
         with:
           # Emit inline annotations rather than SARIF: results land on the PR
           # without depending on code scanning being enabled for the repo.