diff --git a/slsa_with_provenance/action.yml b/slsa_with_provenance/action.yml
index 963539a..e0418c8 100644
--- a/slsa_with_provenance/action.yml
+++ b/slsa_with_provenance/action.yml
@@ -33,14 +33,14 @@ runs:
       shell: bash
 
     # This needs to persis its credentials to store the attestations
-    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-    - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
+    - uses: actions/setup-go@7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 # v6.2.0
       if: inputs.build-from-source == 'true'
       with:
         go-version: '1.24' # We pin this as it is cloning two repos
 
-    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       id: checkout_sourcetool_code
       if: inputs.build-from-source == 'true'
       with: