diff --git a/.github/workflows/assets.yml b/.github/workflows/assets.yml
index ad712e3..9465b11 100644
--- a/.github/workflows/assets.yml
+++ b/.github/workflows/assets.yml
@@ -30,7 +30,7 @@ jobs:
           sudo apt-get install -y inkscape
       - name: Generate brand assets
         run: python scripts/build_assets.py --output build/assets
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: libresign-brand-assets
           path: build/assets/
diff --git a/.github/workflows/latest.yml b/.github/workflows/latest.yml
index 2fe5890..25406d5 100644
--- a/.github/workflows/latest.yml
+++ b/.github/workflows/latest.yml
@@ -28,7 +28,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-      - uses: typst-community/setup-typst@9107b8dd77d7a7fd6c5faebbb507cac28069042e # v5.3
+      - uses: typst-community/setup-typst@fee4b65b091cc546f02ce3be15fad8760f38a108 # v5.3
         with:
           typst-version: 0.15.1
       - name: Install asset toolchain
diff --git a/.github/workflows/manual.yml b/.github/workflows/manual.yml
index 5ba4536..ecef315 100644
--- a/.github/workflows/manual.yml
+++ b/.github/workflows/manual.yml
@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: typst-community/setup-typst@9107b8dd77d7a7fd6c5faebbb507cac28069042e # v5.3
+      - uses: typst-community/setup-typst@fee4b65b091cc546f02ce3be15fad8760f38a108 # v5.3
         with:
           typst-version: 0.15.1
       - name: Check Typst formatting
@@ -60,7 +60,7 @@ jobs:
             -v "$PWD/build:/data:ro" \
             verapdf/cli:latest \
             --flavour ua1 --format text /data/brand-manual-slides.pdf
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: brand-manual
           path: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0c20d5a..f78c173 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      - uses: typst-community/setup-typst@9107b8dd77d7a7fd6c5faebbb507cac28069042e # v5.3
+      - uses: typst-community/setup-typst@fee4b65b091cc546f02ce3be15fad8760f38a108 # v5.3
         with:
           typst-version: 0.15.1
       - name: Install asset toolchain