diff --git a/.github/workflows/check-known-host-source.yml b/.github/workflows/check-known-host-source.yml
index 708a0c2..b3eb95c 100644
--- a/.github/workflows/check-known-host-source.yml
+++ b/.github/workflows/check-known-host-source.yml
@@ -24,7 +24,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Set up Python
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0
         with:
           python-version: "3.14"
       - name: Test source diagnostic with synthetic material
@@ -48,7 +48,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Configure existing AWS SOPS KMS access
-        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c
+        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd
         with:
           role-to-assume: arn:aws:iam::332355796717:role/github-actions-sops-kms
           aws-region: us-west-2