diff --git a/.github/workflows/pre-submit.units.yml b/.github/workflows/pre-submit.units.yml
index 02fff2c..1c9ad6a 100644
--- a/.github/workflows/pre-submit.units.yml
+++ b/.github/workflows/pre-submit.units.yml
@@ -49,7 +49,7 @@ jobs:
       - name: unit tests
         run: make go-test
       - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@0565863a31f2c772f9f0395002a31e3f06189574 # v5.4.0
+        uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: coverage.out
diff --git a/.github/workflows/schedule.issue-reopener.yml b/.github/workflows/schedule.issue-reopener.yml
index ce9ce5e..6610b86 100644
--- a/.github/workflows/schedule.issue-reopener.yml
+++ b/.github/workflows/schedule.issue-reopener.yml
@@ -33,4 +33,4 @@ jobs:
         with:
           persist-credentials: false
       - name: Issue Reopener
-        uses: ianlewis/todo-issue-reopener@8fbb85e63a9f9b6a4d92d5422cda6a55dfbd266d # v1.6.0
+        uses: ianlewis/todo-issue-reopener@05ca1b2493e450e1cc464bb25e0fa735ae8e4a00 # v1.7.0