diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2c9b8b7..69bedd4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -425,7 +425,7 @@ jobs:
 
       - name: Determine version (NBGV)
         id: nbgv
-        uses: dotnet/nbgv@ac67c7ee2e5c3b12feb09df8af3484e4ecf009bb  # v0.4.x — pinned for supply-chain integrity
+        uses: dotnet/nbgv@a776da7e5cb9880ff2cd046e8148564a462de00e  # v0.4.x — pinned for supply-chain integrity
         with:
           setAllVars: true
 
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 600ebc7..6002fd9 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -27,7 +27,7 @@ jobs:
           dotnet-version: 10.0.x
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.37.6
+        uses: github/codeql-action/init@v4.37.7
         with:
           languages: csharp
 
@@ -35,4 +35,4 @@ jobs:
         run: dotnet build Flawright.slnx --configuration Release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4.37.6
+        uses: github/codeql-action/analyze@v4.37.7
diff --git a/.github/workflows/pr-validation.yml b/.github/workflows/pr-validation.yml
index 15ba55a..9486de5 100644
--- a/.github/workflows/pr-validation.yml
+++ b/.github/workflows/pr-validation.yml
@@ -46,7 +46,7 @@ jobs:
 
       - name: Determine version (NBGV)
         id: nbgv
-        uses: dotnet/nbgv@ac67c7ee2e5c3b12feb09df8af3484e4ecf009bb  # v0.4.x — pinned for supply-chain integrity
+        uses: dotnet/nbgv@a776da7e5cb9880ff2cd046e8148564a462de00e  # v0.4.x — pinned for supply-chain integrity
         with:
           setAllVars: true