diff --git a/.github/workflows/lint-and-test.yaml b/.github/workflows/lint-and-test.yaml
index 1ca3584..402dd5f 100644
--- a/.github/workflows/lint-and-test.yaml
+++ b/.github/workflows/lint-and-test.yaml
@@ -136,7 +136,7 @@ jobs:
           version: ${{ matrix.helm-version }}
 
       - name: Set up chart-testing
-        uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f # v2.8.0
+        uses: helm/chart-testing-action@720270857a28afd41e2426521a7801db09e9b510 # v2.9.0
 
       - name: Run ct lint
         id: ct-lint
@@ -225,7 +225,7 @@ jobs:
         # v7 rather than v4: v4 runs on Node 20, which the runners now force onto
         # Node 24 with a deprecation warning on every run. Inputs and the
         # artifact-url output the summary step reads are unchanged.
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: rendered-manifests-helm-${{ matrix.helm-version }}
           path: rendered/
@@ -440,10 +440,10 @@ jobs:
           version: ${{ matrix.helm-version }}
 
       - name: Set up chart-testing
-        uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f # v2.8.0
+        uses: helm/chart-testing-action@720270857a28afd41e2426521a7801db09e9b510 # v2.9.0
 
       - name: Create kind cluster
-        uses: helm/kind-action@06c1ae10762d3b9c1644e7fe69596ae519e015a2 # v1.15.0
+        uses: helm/kind-action@1544676c07bb3570fcb70166beaa07c4528fd4aa # v1.15.1
         with:
           node_image: kindest/node:${{ matrix.k8s-version }}