diff --git a/.github/workflows/community.yml b/.github/workflows/community.yml
index edf5040e0..56f20d8d4 100644
--- a/.github/workflows/community.yml
+++ b/.github/workflows/community.yml
@@ -49,14 +49,14 @@ jobs:
       PYTHONUNBUFFERED: 1
     steps:
       - name: Checkout
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Set up Python
         uses: ./.github/actions/setup-python
         id: setup-python
 
       - name: Install python packages
-        uses: Alfresco/alfresco-build-tools/.github/actions/pipenv@bd803ea1bf16464eaf9726560c0496b41d15c03f # v7.1.0
+        uses: Alfresco/alfresco-build-tools/.github/actions/pipenv@a0837df06d10de2cae8a99319e8e101a6cbe9083 # v8.4.0
         with:
           python-version: ${{ steps.setup-python.outputs.python-version }}
 
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 8a776e11a..8df9682b1 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -54,7 +54,7 @@ jobs:
     runs-on: ${{ inputs.runner }}
     steps:
       - name: Checkout
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           # avoid auth conflict when cloning DTAS during verify step
           persist-credentials: false
@@ -64,7 +64,7 @@ jobs:
         id: setup-python
 
       - name: Install python packages
-        uses: Alfresco/alfresco-build-tools/.github/actions/pipenv@bd803ea1bf16464eaf9726560c0496b41d15c03f # v7.1.0
+        uses: Alfresco/alfresco-build-tools/.github/actions/pipenv@a0837df06d10de2cae8a99319e8e101a6cbe9083 # v8.4.0
         with:
           python-version: ${{ steps.setup-python.outputs.python-version }}
 
diff --git a/.github/workflows/enteprise.yml b/.github/workflows/enteprise.yml
index 743c6ed2f..fcbe92c3e 100644
--- a/.github/workflows/enteprise.yml
+++ b/.github/workflows/enteprise.yml
@@ -70,14 +70,14 @@ jobs:
         run: echo "dtas_version=$DTAS_VERSION" >> $GITHUB_OUTPUT
 
       - name: Checkout
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Setup Python
         uses: ./.github/actions/setup-python
         id: setup-python
 
       - name: Install python packages
-        uses: Alfresco/alfresco-build-tools/.github/actions/pipenv@bd803ea1bf16464eaf9726560c0496b41d15c03f # v7.1.0
+        uses: Alfresco/alfresco-build-tools/.github/actions/pipenv@a0837df06d10de2cae8a99319e8e101a6cbe9083 # v8.4.0
         with:
           python-version: ${{ steps.setup-python.outputs.python-version }}
 
@@ -177,7 +177,7 @@ jobs:
       MOLECULE_IT_AWS_VPC_SUBNET_ID: subnet-6bdd4223
     steps:
       - name: Checkout
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           # avoid auth conflict when cloning DTAS during verify step
           persist-credentials: false
diff --git a/.github/workflows/enterprise-extended.yml b/.github/workflows/enterprise-extended.yml
index eff3bc2b2..2d45951ac 100644
--- a/.github/workflows/enterprise-extended.yml
+++ b/.github/workflows/enterprise-extended.yml
@@ -32,7 +32,7 @@ jobs:
       MOLECULE_IT_AWS_VPC_SUBNET_ID: subnet-6bdd4223
     steps:
       - name: Checkout
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           # avoid auth conflict when cloning DTAS during verify step
           persist-credentials: false
diff --git a/.github/workflows/kics.yml b/.github/workflows/kics.yml
index e13b9e0de..08199ac32 100644
--- a/.github/workflows/kics.yml
+++ b/.github/workflows/kics.yml
@@ -21,9 +21,9 @@ jobs:
   kics:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Run KICS Scan
-        uses: checkmarx/kics-github-action@530ac1f8efe6202b0f12c9a6e952597ae707b755 # v2.1.2
+        uses: checkmarx/kics-github-action@94469746ec2c43de89a42fb9d2a80070f5d25b16 # v2.1.3
         with:
           path: 'playbooks,roles'
           ignore_on_exit: results
@@ -34,6 +34,6 @@ jobs:
           platform_type: ansible
           disable_secrets: true
       - name: Upload SARIF file
-        uses: github/codeql-action/upload-sarif@e2b3eafc8d227b0241d48be5f425d47c2d750a13 # v3.26.10
+        uses: github/codeql-action/upload-sarif@396bb3e45325a47dd9ef434068033c6d5bb0d11a # v3.27.3
         with:
           sarif_file: report-dir/results.sarif
diff --git a/.github/workflows/mirror-libreoffice.yml b/.github/workflows/mirror-libreoffice.yml
index ef478e45c..2aefaec12 100644
--- a/.github/workflows/mirror-libreoffice.yml
+++ b/.github/workflows/mirror-libreoffice.yml
@@ -38,7 +38,7 @@ jobs:
         run: gpg --verify ${FILENAME}.asc
 
       - name: Deploy to nexus
-        uses: Alfresco/alfresco-build-tools/.github/actions/maven-deploy-file@bd803ea1bf16464eaf9726560c0496b41d15c03f # v7.1.0
+        uses: Alfresco/alfresco-build-tools/.github/actions/maven-deploy-file@a0837df06d10de2cae8a99319e8e101a6cbe9083 # v8.4.0
         with:
           group-id: org.libreoffice
           artifact-id: libreoffice-dist
diff --git a/.github/workflows/precommit.yml b/.github/workflows/precommit.yml
index 363dcb06a..3ca341502 100644
--- a/.github/workflows/precommit.yml
+++ b/.github/workflows/precommit.yml
@@ -11,7 +11,7 @@ jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 2
 
@@ -20,7 +20,7 @@ jobs:
         id: setup-python
 
       - name: Install python packages
-        uses: Alfresco/alfresco-build-tools/.github/actions/pipenv@bd803ea1bf16464eaf9726560c0496b41d15c03f # v7.1.0
+        uses: Alfresco/alfresco-build-tools/.github/actions/pipenv@a0837df06d10de2cae8a99319e8e101a6cbe9083 # v8.4.0
         with:
           python-version: ${{ steps.setup-python.outputs.python-version }}
 
@@ -28,7 +28,7 @@ jobs:
         uses: ./.github/actions/galaxy
 
       - name: Cache pre-commit
-        uses: actions/cache@0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 # v4.0.2
+        uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a # v4.1.2
         with:
           path: ~/.cache/pre-commit
           key: ${{ runner.os }}-precommit-${{ hashFiles('.pre-commit-config.yaml') }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4ac9807cd..360e8a175 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Get tag name
         shell: bash
diff --git a/.github/workflows/updatecli.yml b/.github/workflows/updatecli.yml
index c46f30721..c17b158bf 100644
--- a/.github/workflows/updatecli.yml
+++ b/.github/workflows/updatecli.yml
@@ -34,13 +34,13 @@ jobs:
           - updatecli_acs72.yml
           - updatecli_acs71.yml
     steps:
-      - uses: actions/checkout@d632683dd7b4114ad314bca15554477dd762a938 # v4.2.0
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: ${{ github.head_ref || github.ref_name }}
           token: ${{ secrets.BOT_GITHUB_TOKEN }}
 
       - name: Install Updatecli
-        uses: updatecli/updatecli-action@92a13b95c2cd9f1c6742c965509203c6a5635ed7  # v2.68.0
+        uses: updatecli/updatecli-action@704a64517239e0993c5e3bf6749a063b8f950d9f  # v2.70.0
 
       - name: Run Updatecli in ${{ env.UPDATECLI_MODE }} mode
         run: >-