diff --git a/.github/workflows/cli-ci.yml b/.github/workflows/cli-ci.yml
index f66ab7209d0..d28b66b5d34 100644
--- a/.github/workflows/cli-ci.yml
+++ b/.github/workflows/cli-ci.yml
@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
         with:
           node-version: "20"
       - run: npm install -g cspell@8.13.1
@@ -141,10 +141,10 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: cli/azd/go.mod
       - name: Install Buf
diff --git a/.github/workflows/copilot-setup-steps.yml b/.github/workflows/copilot-setup-steps.yml
index d27b3c4bd10..746261dd9c5 100644
--- a/.github/workflows/copilot-setup-steps.yml
+++ b/.github/workflows/copilot-setup-steps.yml
@@ -46,7 +46,7 @@ jobs:
           go-version-file: cli/azd/go.mod
 
       - name: Set up Node.js
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
         with:
           node-version: "20"
 
diff --git a/.github/workflows/cspell-ext.yml b/.github/workflows/cspell-ext.yml
index 31e5cf242c3..fb91ce7ba81 100644
--- a/.github/workflows/cspell-ext.yml
+++ b/.github/workflows/cspell-ext.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
         with:
           node-version: "20"
       - run: npm install -g cspell@8.13.1
diff --git a/.github/workflows/cspell-misc.yml b/.github/workflows/cspell-misc.yml
index bfb301eb071..42a8fe82a23 100644
--- a/.github/workflows/cspell-misc.yml
+++ b/.github/workflows/cspell-misc.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
         with:
           node-version: "20"
       - run: npm install -g cspell@8.13.1
diff --git a/.github/workflows/devcontainer-feature-release.yml b/.github/workflows/devcontainer-feature-release.yml
index c9d22ef1f58..9f9c82292f7 100644
--- a/.github/workflows/devcontainer-feature-release.yml
+++ b/.github/workflows/devcontainer-feature-release.yml
@@ -26,7 +26,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: "Publish Features"
-        uses: devcontainers/action@1082abd5d2bf3a11abccba70eef98df068277772  # v1.4.3
+        uses: devcontainers/action@bef2cf2d1a019b00b45e184f83035e01bd1972f3  # v1.4.4
         with:
           publish-features: "true"
           base-path-to-features: "./ext/devcontainer/src"
diff --git a/.github/workflows/devops-ext-ci.yml b/.github/workflows/devops-ext-ci.yml
index 7e9b633275c..0752a133082 100644
--- a/.github/workflows/devops-ext-ci.yml
+++ b/.github/workflows/devops-ext-ci.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
         with:
           node-version: "20"
       - name: Install dependencies
diff --git a/.github/workflows/eval-scenario-ci.yml b/.github/workflows/eval-scenario-ci.yml
index 9d08bbc58ca..020b424ca55 100644
--- a/.github/workflows/eval-scenario-ci.yml
+++ b/.github/workflows/eval-scenario-ci.yml
@@ -43,7 +43,7 @@ jobs:
           persist-credentials: false
 
       - name: Set up Python 3.12
-        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+        uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
         with:
           python-version: "3.12"
 
diff --git a/.github/workflows/lint-ext-azure-ai-evaluations.yml b/.github/workflows/lint-ext-azure-ai-evaluations.yml
index 8fde854224e..996ca19a48f 100644
--- a/.github/workflows/lint-ext-azure-ai-evaluations.yml
+++ b/.github/workflows/lint-ext-azure-ai-evaluations.yml
@@ -31,8 +31,8 @@ jobs:
     name: unit tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-go@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: cli/azd/extensions/azure.ai.evaluations/go.mod
           cache-dependency-path: cli/azd/extensions/azure.ai.evaluations/go.sum
diff --git a/.github/workflows/schema-ci.yml b/.github/workflows/schema-ci.yml
index 44d5c98d2ce..22837a281cb 100644
--- a/.github/workflows/schema-ci.yml
+++ b/.github/workflows/schema-ci.yml
@@ -27,7 +27,7 @@ jobs:
         run: go tool mage schema:check
 # NOTE: Using jsonschema2md here to ensure the schemas are valid for documentation generation.
 #       Since we use jsonschema2md for CI pipelines, any changes to the schemas should make sure to keep the tool happy.
-      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
+      - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0  # v7.1.0
         with:
           python-version: '3.x'
       - run: pip install jsonschema2md==1.5.2
diff --git a/.github/workflows/scripts-ci.yml b/.github/workflows/scripts-ci.yml
index 323b9b1b87b..4ec0cb9b789 100644
--- a/.github/workflows/scripts-ci.yml
+++ b/.github/workflows/scripts-ci.yml
@@ -32,7 +32,7 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up Node
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
         with:
           # 24 is the version that the GitHub actions script I'm running should also be 
           # running under.
diff --git a/.github/workflows/vscode-ci.yml b/.github/workflows/vscode-ci.yml
index a9d9ed56c86..10489579648 100644
--- a/.github/workflows/vscode-ci.yml
+++ b/.github/workflows/vscode-ci.yml
@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
         with:
           node-version: "22"
       - run: npm install -g cspell@8.13.1
@@ -43,7 +43,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020  # v7.0.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
         with:
           node-version: ${{ matrix.node-version }}
 
@@ -78,7 +78,7 @@ jobs:
 
       - name: 'Upload azd binary to artifact store (upload-artifact: true only)'
         if: matrix.upload-artifact == true
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
         with:
           name: package
           path: ./ext/vscode/azure-dev*.vsix