diff --git a/.github/workflows/upstream-refresh.yml b/.github/workflows/upstream-refresh.yml
index ec5a033..1d071e1 100644
--- a/.github/workflows/upstream-refresh.yml
+++ b/.github/workflows/upstream-refresh.yml
@@ -81,7 +81,7 @@ jobs:
       - name: Create update pull request
         id: pull-request
         if: steps.refresh.outcome == 'success'
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        uses: peter-evans/create-pull-request@15733dbdfeedb4f7fdb73d13c6f5ac83b710fab8 # v8.1.2
         with:
           token: ${{ steps.app-token.outputs.token }}
           commit-message: 'chore: refresh upstream workflow pins'
diff --git a/.github/workflows/zizmor.yml b/.github/workflows/zizmor.yml
index 0645120..0641b31 100644
--- a/.github/workflows/zizmor.yml
+++ b/.github/workflows/zizmor.yml
@@ -25,7 +25,7 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@53290badfa369cb0bf7ad16342cb62c2fa47ac7b # v0.8.0
+        uses: zizmorcore/zizmor-action@45d7276c9ca790aabd705e31ca99c6185c3e76dd # v0.8.1
         with:
           version: 1.30.1
           advanced-security: false