diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4653878..8f6eafc 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -38,7 +38,7 @@ jobs:
         with:
           python-version-file: .python-version
       - uses: gradle/actions/wrapper-validation@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
-      - uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1
+      - uses: android-actions/setup-android@be39fa834029ff78f1a44aa3bb0819b8fc2bd8fd # v4.0.4
         with:
           packages: platform-tools platforms;android-37.0 build-tools;37.0.0
       - name: Resolve automatic version
@@ -145,7 +145,7 @@ jobs:
       - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version-file: .python-version
-      - uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1
+      - uses: android-actions/setup-android@be39fa834029ff78f1a44aa3bb0819b8fc2bd8fd # v4.0.4
         with:
           packages: platform-tools build-tools;37.0.0
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 68c7a24..a011d9d 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -61,11 +61,11 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      - uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4
+      - uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4
         with:
           languages: ${{ matrix.language }}
           build-mode: none
-      - uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4
+      - uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4
         with:
           category: .github/workflows/ci.yml:codeql/language:${{ matrix.language }}
 
@@ -89,7 +89,7 @@ jobs:
         with:
           python-version-file: .python-version
       - uses: gradle/actions/wrapper-validation@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
-      - uses: android-actions/setup-android@40fd30fb8d7440372e1316f5d1809ec01dcd3699 # v4.0.1
+      - uses: android-actions/setup-android@be39fa834029ff78f1a44aa3bb0819b8fc2bd8fd # v4.0.4
         with:
           packages: platform-tools platforms;android-37.0 build-tools;37.0.0
       # Same temporary Kotlin 2.4.20 workaround as Contracts. Remove when the
@@ -103,7 +103,7 @@ jobs:
           bundle="$RUNNER_TEMP/codeql-bundle-java-linux64.tar.zst"
           curl --fail --silent --show-error --location "$CODEQL_BUNDLE_URL" --output "$bundle"
           printf '%s  %s\n' "$CODEQL_BUNDLE_SHA256" "$bundle" | sha256sum --check --strict
-      - uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4
+      - uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4
         with:
           languages: java-kotlin
           build-mode: manual
@@ -119,6 +119,6 @@ jobs:
           ./gradlew --no-daemon --console=plain --no-build-cache
           -PreleaseVersionName="$VERSION_NAME" -PreleaseVersionCode="$VERSION_CODE"
           clean :app:assembleDebug :shared:desktopJar
-      - uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4
+      - uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4
         with:
           category: .github/workflows/ci.yml:codeql-kotlin