diff --git a/.github/workflows/automerge.yml b/.github/workflows/automerge.yml
index a304a6a42..14de5e1df 100644
--- a/.github/workflows/automerge.yml
+++ b/.github/workflows/automerge.yml
@@ -37,7 +37,7 @@ jobs:
           ref: ${{ github.ref }}
 
       - name: setup conda
-        uses: mamba-org/setup-micromamba@06375d89d211a1232ef63355742e9e2e564bc7f7 # v1
+        uses: mamba-org/setup-micromamba@068f1ab4b37ed9b3d9f73da7db90a0cda0a48d29 # v1
         with:
           environment-file: conda-lock.yml
           environment-name: webservices
@@ -49,7 +49,7 @@ jobs:
 
       - name: generate token
         id: generate_token
-        uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1
+        uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1
         with:
           app-id: ${{ secrets.CF_CURATOR_APP_ID }}
           private-key: ${{ secrets.CF_CURATOR_PRIVATE_KEY }}
diff --git a/.github/workflows/clean-and-update.yml b/.github/workflows/clean-and-update.yml
index 62a327a31..8937eb099 100644
--- a/.github/workflows/clean-and-update.yml
+++ b/.github/workflows/clean-and-update.yml
@@ -15,14 +15,14 @@ jobs:
 
       - name: generate token
         id: generate_token
-        uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1
+        uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1
         with:
           app-id: ${{ secrets.CF_CURATOR_APP_ID }}
           private-key: ${{ secrets.CF_CURATOR_PRIVATE_KEY }}
           owner: ${{ github.repository_owner }}
 
       - name: relock
-        uses: beckermr/relock-conda@7e9057f62545d3b3a3fc10ccc93cec4d0bd2c5a5
+        uses: beckermr/relock-conda@7dd1c7ebd71d3389ba3dad4864b9fb6c2208a1d9
         with:
           github-token: ${{ steps.generate_token.outputs.token }}
           automerge: true
@@ -50,7 +50,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
 
       - name: setup conda
-        uses: mamba-org/setup-micromamba@06375d89d211a1232ef63355742e9e2e564bc7f7 # v1
+        uses: mamba-org/setup-micromamba@068f1ab4b37ed9b3d9f73da7db90a0cda0a48d29 # v1
         with:
           environment-file: conda-lock.yml
           environment-name: webservices
@@ -62,7 +62,7 @@ jobs:
 
       - name: generate token
         id: generate_token
-        uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1
+        uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1
         with:
           app-id: ${{ secrets.CF_CURATOR_APP_ID }}
           private-key: ${{ secrets.CF_CURATOR_PRIVATE_KEY }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 933f46d74..639874c86 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -28,7 +28,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: mamba-org/setup-micromamba@06375d89d211a1232ef63355742e9e2e564bc7f7 # v1
+      - uses: mamba-org/setup-micromamba@068f1ab4b37ed9b3d9f73da7db90a0cda0a48d29 # v1
         with:
           environment-file: conda-lock.yml
           environment-name: webservices
@@ -67,7 +67,7 @@ jobs:
         with:
           fetch-depth: 0
 
-      - uses: mamba-org/setup-micromamba@06375d89d211a1232ef63355742e9e2e564bc7f7 # v1
+      - uses: mamba-org/setup-micromamba@068f1ab4b37ed9b3d9f73da7db90a0cda0a48d29 # v1
         with:
           environment-file: conda-lock.yml
           environment-name: webservices
@@ -78,7 +78,7 @@ jobs:
               - conda-forge
 
       - name: set up docker buildx
-        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3
+        uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3
 
       - name: login to docker hub
         uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # v3
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 4f0e6e065..37861c9c9 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -28,7 +28,7 @@ jobs:
           fetch-depth: 0
 
       - name: setup conda
-        uses: mamba-org/setup-micromamba@06375d89d211a1232ef63355742e9e2e564bc7f7 # v1
+        uses: mamba-org/setup-micromamba@068f1ab4b37ed9b3d9f73da7db90a0cda0a48d29 # v1
         with:
           environment-file: conda-lock.yml
           environment-name: webservices
@@ -41,7 +41,7 @@ jobs:
       - name: generate token
         id: generate_token
         if: ${{ !github.event.pull_request.head.repo.fork }}
-        uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1
+        uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1
         with:
           app-id: ${{ secrets.CF_CURATOR_APP_ID }}
           private-key: ${{ secrets.CF_CURATOR_PRIVATE_KEY }}
@@ -94,7 +94,7 @@ jobs:
           fetch-depth: 0
 
       - name: setup conda
-        uses: mamba-org/setup-micromamba@06375d89d211a1232ef63355742e9e2e564bc7f7 # v1
+        uses: mamba-org/setup-micromamba@068f1ab4b37ed9b3d9f73da7db90a0cda0a48d29 # v1
         with:
           environment-file: conda-lock.yml
           environment-name: webservices
@@ -117,7 +117,7 @@ jobs:
 
       - name: set up docker buildx
         if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'conda-forge/conda-forge-webservices'
-        uses: docker/setup-buildx-action@c47758b77c9736f4b2ef4073d4d51994fabfe349 # v3
+        uses: docker/setup-buildx-action@6524bf65af31da8d45b59e8c27de4bd072b392f5 # v3
 
       - name: login to docker hub
         if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == 'conda-forge/conda-forge-webservices'
@@ -151,7 +151,7 @@ jobs:
 
       - name: setup conda
         if: ${{ !github.event.pull_request.head.repo.fork }}
-        uses: mamba-org/setup-micromamba@06375d89d211a1232ef63355742e9e2e564bc7f7 # v1
+        uses: mamba-org/setup-micromamba@068f1ab4b37ed9b3d9f73da7db90a0cda0a48d29 # v1
         with:
           environment-file: conda-lock.yml
           environment-name: webservices
@@ -164,7 +164,7 @@ jobs:
       - name: generate token
         if: ${{ !github.event.pull_request.head.repo.fork }}
         id: generate_token
-        uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1
+        uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1
         with:
           app-id: ${{ secrets.CF_CURATOR_APP_ID }}
           private-key: ${{ secrets.CF_CURATOR_PRIVATE_KEY }}
@@ -211,7 +211,7 @@ jobs:
 
       - name: setup conda
         if: ${{ !github.event.pull_request.head.repo.fork }}
-        uses: mamba-org/setup-micromamba@06375d89d211a1232ef63355742e9e2e564bc7f7 # v1
+        uses: mamba-org/setup-micromamba@068f1ab4b37ed9b3d9f73da7db90a0cda0a48d29 # v1
         with:
           environment-file: conda-lock.yml
           environment-name: webservices
@@ -224,7 +224,7 @@ jobs:
       - name: generate token
         if: ${{ !github.event.pull_request.head.repo.fork }}
         id: generate_token
-        uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1
+        uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1
         with:
           app-id: ${{ secrets.CF_CURATOR_APP_ID }}
           private-key: ${{ secrets.CF_CURATOR_PRIVATE_KEY }}
@@ -275,7 +275,7 @@ jobs:
 
       - name: setup conda
         if: ${{ !github.event.pull_request.head.repo.fork }}
-        uses: mamba-org/setup-micromamba@06375d89d211a1232ef63355742e9e2e564bc7f7 # v1
+        uses: mamba-org/setup-micromamba@068f1ab4b37ed9b3d9f73da7db90a0cda0a48d29 # v1
         with:
           environment-file: conda-lock.yml
           environment-name: webservices
@@ -288,7 +288,7 @@ jobs:
       - name: generate token
         if: ${{ !github.event.pull_request.head.repo.fork }}
         id: generate_token
-        uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1
+        uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1
         with:
           app-id: ${{ secrets.CF_CURATOR_APP_ID }}
           private-key: ${{ secrets.CF_CURATOR_PRIVATE_KEY }}
@@ -339,7 +339,7 @@ jobs:
 
       - name: setup conda
         if: ${{ !github.event.pull_request.head.repo.fork }}
-        uses: mamba-org/setup-micromamba@06375d89d211a1232ef63355742e9e2e564bc7f7 # v1
+        uses: mamba-org/setup-micromamba@068f1ab4b37ed9b3d9f73da7db90a0cda0a48d29 # v1
         with:
           environment-file: conda-lock.yml
           environment-name: webservices
@@ -352,7 +352,7 @@ jobs:
       - name: generate token
         if: ${{ !github.event.pull_request.head.repo.fork }}
         id: generate_token
-        uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1
+        uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1
         with:
           app-id: ${{ secrets.CF_CURATOR_APP_ID }}
           private-key: ${{ secrets.CF_CURATOR_PRIVATE_KEY }}
@@ -402,7 +402,7 @@ jobs:
 
       - name: setup conda
         if: ${{ !github.event.pull_request.head.repo.fork }}
-        uses: mamba-org/setup-micromamba@06375d89d211a1232ef63355742e9e2e564bc7f7 # v1
+        uses: mamba-org/setup-micromamba@068f1ab4b37ed9b3d9f73da7db90a0cda0a48d29 # v1
         with:
           environment-file: conda-lock.yml
           environment-name: webservices
@@ -415,7 +415,7 @@ jobs:
       - name: generate token
         if: ${{ !github.event.pull_request.head.repo.fork }}
         id: generate_token
-        uses: actions/create-github-app-token@5d869da34e18e7287c1daad50e0b8ea0f506ce69 # v1
+        uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # v1
         with:
           app-id: ${{ secrets.CF_CURATOR_APP_ID }}
           private-key: ${{ secrets.CF_CURATOR_PRIVATE_KEY }}
diff --git a/.github/workflows/webservices-workflow-dispatch.yml b/.github/workflows/webservices-workflow-dispatch.yml
index ae925eb9d..4c0beeaf7 100644
--- a/.github/workflows/webservices-workflow-dispatch.yml
+++ b/.github/workflows/webservices-workflow-dispatch.yml
@@ -58,7 +58,7 @@ jobs:
           ref: ${{ github.ref }}
 
       - name: setup conda
-        uses: mamba-org/setup-micromamba@06375d89d211a1232ef63355742e9e2e564bc7f7
+        uses: mamba-org/setup-micromamba@068f1ab4b37ed9b3d9f73da7db90a0cda0a48d29
         with:
           environment-file: conda-lock.yml
           environment-name: webservices
@@ -110,7 +110,7 @@ jobs:
           ref: ${{ github.ref }}
 
       - name: setup conda
-        uses: mamba-org/setup-micromamba@06375d89d211a1232ef63355742e9e2e564bc7f7
+        uses: mamba-org/setup-micromamba@068f1ab4b37ed9b3d9f73da7db90a0cda0a48d29
         with:
           environment-file: conda-lock.yml
           environment-name: webservices