diff --git a/.github/workflows/pr-description-check.yml b/.github/workflows/pr-description-check.yml
index ac7817a86..d722dfff3 100644
--- a/.github/workflows/pr-description-check.yml
+++ b/.github/workflows/pr-description-check.yml
@@ -18,7 +18,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Check PR description quality
-        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           script: |
             const MIN_BODY_LENGTH = 50;
diff --git a/.github/workflows/triage-sweep.yml b/.github/workflows/triage-sweep.yml
index 5ae12536b..9e48dd75d 100644
--- a/.github/workflows/triage-sweep.yml
+++ b/.github/workflows/triage-sweep.yml
@@ -25,8 +25,8 @@ on:
         default: 500
       dry_run:
         description: >-
-          If true, print the report to workflow logs but do not create
-          a GitHub issue.
+          Check this to only log results to the workflow summary.
+          Uncheck to create a GitHub issue with the report and apply labels.
         type: boolean
         default: false
 
@@ -44,14 +44,14 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout repository
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           sparse-checkout: .github/scripts/triage
           sparse-checkout-cone-mode: false
           fetch-depth: 1
 
       - name: Set up Python
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
         with:
           python-version: '3.12'
           cache: pip
@@ -61,7 +61,7 @@ jobs:
         run: pip install -r .github/scripts/triage/requirements.txt
 
       - name: Cache FastEmbed model weights
-        uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: ~/.cache/fastembed_cache
           key: fastembed-bge-small-en-v1.5