diff --git a/.github/actions-lock.txt b/.github/actions-lock.txt
index 505fb4a7a..6f4d2b668 100644
--- a/.github/actions-lock.txt
+++ b/.github/actions-lock.txt
@@ -1,15 +1,15 @@
 # SPDX-FileCopyrightText: 2025 Nextcloud GmbH and Nextcloud contributors
 # SPDX-License-Identifier: MIT
-ed8f08fe0c056080f6afef29f15b2d49 appstore-build-publish.yml
-e6351c608939c31ae1e32923aa82aa10 dependabot-approve-merge.yml
+2afe22a01c1c2413f0cf48d010a13396 appstore-build-publish.yml
+c1476a553c3223e70e49de980f22315e dependabot-approve-merge.yml
 2581a67c5bcdcd570427e6d51db767d7 fixup.yml
-dc0ae733f35c60274937c2647c027d46 lint-eslint.yml
+3ebb059d675980d618b9727fb3792d00 lint-eslint.yml
 43fd0c5fb704cabc5f11cdfaf513236d lint-info-xml.yml
 79006ab196f5664fc444e63645cfd8a7 lint-php-cs.yml
 300be6a756abda800e40850918f2d964 lint-php.yml
-ab3a506506b1d7c1cea9593ecfd84366 lint-stylelint.yml
-d5f511793e785e83842609afc0317b24 node-test.yml
-b45e44d9ffe39586b38b6a925c1a9740 openapi.yml
+d35c01a3f110e52eed0e0c422747a417 lint-stylelint.yml
+114bbea1108739b7dd46888e42691563 node-test.yml
+1a869a2906ae6d57be06ed83062687ce openapi.yml
 6d8eebf482b2932971b7912139f16d9f phpunit-mariadb.yml
 3cacf28a710b387e83d3858af40b7ffe phpunit-mysql.yml
 f89c18551d6a29af9bca63a0fd30a039 phpunit-oci.yml
diff --git a/.github/workflows/appstore-build-publish.yml b/.github/workflows/appstore-build-publish.yml
index 699f6d691..ba35bd80a 100644
--- a/.github/workflows/appstore-build-publish.yml
+++ b/.github/workflows/appstore-build-publish.yml
@@ -59,7 +59,7 @@ jobs:
           expression: "//info//dependencies//nextcloud/@min-version"
 
       - name: Read package.json node and npm engines version
-        uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
+        uses: skjnldsv/read-package-engines-version-actions@06d6db44aa62f4609ba070f556ec24bc99fb85cb # v4
         id: versions
         # Continue if no package.json
         continue-on-error: true
diff --git a/.github/workflows/dependabot-approve-merge.yml b/.github/workflows/dependabot-approve-merge.yml
index 76340acb5..eaa1e9f28 100644
--- a/.github/workflows/dependabot-approve-merge.yml
+++ b/.github/workflows/dependabot-approve-merge.yml
@@ -9,7 +9,7 @@
 name: Auto approve Dependabot PRs
 
 on:
-  pull_request_target: # zizmor: ignore[dangerous-triggers]
+  pull_request:
     branches:
       - main
       - master
diff --git a/.github/workflows/lint-eslint.yml b/.github/workflows/lint-eslint.yml
index 5ad2d20e5..317e3c675 100644
--- a/.github/workflows/lint-eslint.yml
+++ b/.github/workflows/lint-eslint.yml
@@ -61,7 +61,7 @@ jobs:
           persist-credentials: false
 
       - name: Read package.json node and npm engines version
-        uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
+        uses: skjnldsv/read-package-engines-version-actions@06d6db44aa62f4609ba070f556ec24bc99fb85cb # v4
         id: versions
         with:
           fallbackNode: '^24'
diff --git a/.github/workflows/lint-stylelint.yml b/.github/workflows/lint-stylelint.yml
index e4b26b585..89149dd4e 100644
--- a/.github/workflows/lint-stylelint.yml
+++ b/.github/workflows/lint-stylelint.yml
@@ -30,7 +30,7 @@ jobs:
           persist-credentials: false
 
       - name: Read package.json node and npm engines version
-        uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
+        uses: skjnldsv/read-package-engines-version-actions@06d6db44aa62f4609ba070f556ec24bc99fb85cb # v4
         id: versions
         with:
           fallbackNode: '^24'
diff --git a/.github/workflows/node-test.yml b/.github/workflows/node-test.yml
index aa5dcffed..c25b088f4 100644
--- a/.github/workflows/node-test.yml
+++ b/.github/workflows/node-test.yml
@@ -65,7 +65,7 @@ jobs:
           persist-credentials: false
 
       - name: Read package.json node and npm engines version
-        uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
+        uses: skjnldsv/read-package-engines-version-actions@06d6db44aa62f4609ba070f556ec24bc99fb85cb # v4
         id: versions
         with:
           fallbackNode: '^24'
diff --git a/.github/workflows/openapi.yml b/.github/workflows/openapi.yml
index 748565611..f8a146097 100644
--- a/.github/workflows/openapi.yml
+++ b/.github/workflows/openapi.yml
@@ -52,7 +52,7 @@ jobs:
 
       - name: Read package.json node and npm engines version
         if: steps.check_typescript_openapi.outputs.files_exists == 'true'
-        uses: skjnldsv/read-package-engines-version-actions@06d6baf7d8f41934ab630e97d9e6c0bc9c9ac5e4 # v3
+        uses: skjnldsv/read-package-engines-version-actions@06d6db44aa62f4609ba070f556ec24bc99fb85cb # v4
         id: node_versions
         # Continue if no package.json
         continue-on-error: true