diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 2dc10619..a1c1ac85 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -31,7 +31,7 @@ jobs:
           go-version-file: 'go.mod'
           check-latest: true
 
-      - uses: chainguard-dev/actions/goimports@061bc0e921116bde1470f51fb5c86d5318f16558 # v1.6.15
+      - uses: chainguard-dev/actions/goimports@c69a264ec2a5934c3186c618f368fc1c86f16cff # v1.6.19
       - run: make wolfictl
       - run: make test
 
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 2405683e..0a3794b0 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -73,7 +73,7 @@ jobs:
           fi
 
       - name: Bump and push Git tag
-        uses: chainguard-dev/actions/git-tag@061bc0e921116bde1470f51fb5c86d5318f16558 # v1.6.15
+        uses: chainguard-dev/actions/git-tag@c69a264ec2a5934c3186c618f368fc1c86f16cff # v1.6.19
         if: steps.check.outputs.bump == 'yes'
         with:
           token: ${{ steps.octo-sts.outputs.token }}