diff --git a/.github/workflows/auto-release.yml b/.github/workflows/auto-release.yml
index b72f897..d5c6470 100644
--- a/.github/workflows/auto-release.yml
+++ b/.github/workflows/auto-release.yml
@@ -32,7 +32,7 @@ jobs:
 
       - name: Install Chromium, CJK fonts, and PDF inspection tools
         id: setupchrome
-        uses: browser-actions/setup-chrome@2e1d749697dd1612b833dba4a722266286fbefcd # v2.1.2
+        uses: browser-actions/setup-chrome@48ad923757ca74d66703209fe939badbdf80f2f4 # v2.2.0
         with:
           chrome-version: stable
 
@@ -158,7 +158,7 @@ jobs:
         run: (cd dist && sha256sum -c SHA256SUMS)
 
       - name: Attest tagged release artifacts
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-path: |
             dist/docker_practice-*.pdf
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 3db9632..6efc8aa 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -57,7 +57,7 @@ jobs:
           python3 tools/test_examples.py --require-tools
 
       - name: Install Chromium
-        uses: browser-actions/setup-chrome@2e1d749697dd1612b833dba4a722266286fbefcd # v2.1.2
+        uses: browser-actions/setup-chrome@48ad923757ca74d66703209fe939badbdf80f2f4 # v2.2.0
         with:
           chrome-version: stable
 
diff --git a/.github/workflows/preview-pdf.yml b/.github/workflows/preview-pdf.yml
index 9056009..c560852 100644
--- a/.github/workflows/preview-pdf.yml
+++ b/.github/workflows/preview-pdf.yml
@@ -35,7 +35,7 @@ jobs:
           npm test
 
       - name: Install Chromium
-        uses: browser-actions/setup-chrome@2e1d749697dd1612b833dba4a722266286fbefcd # v2.1.2
+        uses: browser-actions/setup-chrome@48ad923757ca74d66703209fe939badbdf80f2f4 # v2.2.0
         with:
           chrome-version: stable
 
diff --git a/tests/test_workflow_security.py b/tests/test_workflow_security.py
index 08a70e3..a1a03eb 100644
--- a/tests/test_workflow_security.py
+++ b/tests/test_workflow_security.py
@@ -395,9 +395,9 @@ class WorkflowSecurityTests(unittest.TestCase):
         self.assertIn("contents: write", release_job)
         self.assertIn("id-token: write", release_job)
         self.assertIn("attestations: write", release_job)
-        self.assertIn(
-            "actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1",
+        self.assertRegex(
             release_job,
+            r"actions/attest-build-provenance@[0-9a-f]{40} # v\d",
         )
         self.assertIn("subject-path: |", release_job)
         self.assertIn("dist/docker_practice-*.pdf", release_job)