diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 21fe026..fb54bff 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -9,7 +9,7 @@ updates:
     open-pull-requests-limit: 10
     labels:
       - "dependencies"
-      - "github-actions"
+      - "github_actions"
     commit-message:
       prefix: "ci"
       include: "scope"
@@ -27,7 +27,6 @@ updates:
     open-pull-requests-limit: 10
     labels:
       - "dependencies"
-      - "docker"
     commit-message:
       prefix: "docker"
       include: "scope"
@@ -45,7 +44,6 @@ updates:
     open-pull-requests-limit: 10
     labels:
       - "dependencies"
-      - "devcontainers"
     commit-message:
       prefix: "feat"
       include: "scope"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d062ecd..8f05d7a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -34,7 +34,7 @@ jobs:
       security-events: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed # v2.22.0
         with:
           egress-policy: audit
 
@@ -76,7 +76,7 @@ jobs:
 
       - name: Upload gitleaks SARIF
         if: always() && env.UPLOAD_SARIF == 'true'
-        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
         with:
           sarif_file: gitleaks.sarif
           category: security-analysis/gitleaks
@@ -102,7 +102,7 @@ jobs:
       contents: read
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed # v2.22.0
         with:
           egress-policy: audit
 
@@ -135,7 +135,7 @@ jobs:
       security-events: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
+        uses: step-security/harden-runner@351661ca32ac09a36dc5ee2d536e3128f2a3c8ed # v2.22.0
         with:
           egress-policy: audit
 
@@ -169,14 +169,14 @@ jobs:
 
       - name: Upload Trivy image scan results
         if: always() && env.UPLOAD_SARIF == 'true'
-        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
         with:
           sarif_file: 'trivy-results.sarif'
           category: 'security-analysis/trivy-image'
 
       - name: Generate SBOM
         if: always()
-        uses: anchore/sbom-action@3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 # v0.24.2
+        uses: anchore/sbom-action@66cbf4bc1f1c0d2edc94016e65bc221b6bb0ad6c # v0.24.3
         with:
           image: 'dev-template:${{ github.sha }}'
           format: 'spdx-json'
@@ -207,7 +207,7 @@ jobs:
 
       - name: Upload Trivy filesystem scan results
         if: always() && env.UPLOAD_SARIF == 'true'
-        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4
+        uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4
         with:
           sarif_file: 'trivy-fs-results.sarif'
           category: 'security-analysis/trivy-filesystem'