diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index e0b7f27..0b22657 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -28,7 +28,7 @@ jobs:
 
       - name: Calculate version bump
         id: create_tag
-        uses: chainguard-dev/actions/git-tag@0cf1221da92242205c2d9f8a63add344ebd6b304 # v1.6.1
+        uses: chainguard-dev/actions/git-tag@a601adc7b134a61c9110e17c6ebcdff5e2e53bdc # v1.6.2
         with:
           bump_level: patch
           dry_run: true
diff --git a/.github/workflows/update-apko.yaml b/.github/workflows/update-apko.yaml
index f2f4d88..b7ca0f8 100644
--- a/.github/workflows/update-apko.yaml
+++ b/.github/workflows/update-apko.yaml
@@ -47,7 +47,7 @@ jobs:
         echo "create_pr_update=true" >> $GITHUB_OUTPUT
 
     # Configure signed commits
-    - uses: chainguard-dev/actions/setup-gitsign@0cf1221da92242205c2d9f8a63add344ebd6b304 # v1.6.1
+    - uses: chainguard-dev/actions/setup-gitsign@a601adc7b134a61c9110e17c6ebcdff5e2e53bdc # v1.6.2
       if: ${{ steps.check-diff.outputs.create_pr_update == 'true' }}
 
     # Based on usage in https://github.com/chainguard-dev/digestabot/blob/main/action.yml