diff --git a/.github/workflows/chromatic.yml b/.github/workflows/chromatic.yml
index e8d3d2e..391ac7d 100644
--- a/.github/workflows/chromatic.yml
+++ b/.github/workflows/chromatic.yml
@@ -38,7 +38,7 @@ jobs:
         working-directory: lib
 
       - name: Run Chromatic
-        uses: chromaui/action@7aca53e7aa87489020a97f633c1e7e82c12e5973 # latest
+        uses: chromaui/action@05812acac141ce7d317a3f787be88122bca27cf4 # latest
         with:
           projectToken: ${{ secrets.CHROMATIC_PROJECT_TOKEN }}
           workingDir: lib
diff --git a/.github/workflows/security-audit.yaml b/.github/workflows/security-audit.yaml
index 6876c40..959ca6e 100644
--- a/.github/workflows/security-audit.yaml
+++ b/.github/workflows/security-audit.yaml
@@ -57,7 +57,7 @@ jobs:
           exit 1
 
       - name: Audit against SECURITY.md
-        uses: anthropics/claude-code-action@4481e6d3c7bbb88db2a928ca3444c536f589c7c1 # v1
+        uses: anthropics/claude-code-action@593d7a5c4e0073569f74772c2b7b64c30ec14707 # v1
         env:
           # `claude-code-action` resets `GH_TOKEN` to its own internal
           # workflow token, so setting `GH_TOKEN` at this scope is