diff --git a/.github/workflows/auto-merge.yaml b/.github/workflows/auto-merge.yaml
index bd7ad08cf..ea19c33d8 100644
--- a/.github/workflows/auto-merge.yaml
+++ b/.github/workflows/auto-merge.yaml
@@ -22,7 +22,7 @@ name: 'Auto merge'
 
 jobs:
   auto-merge:
-    uses: conforma/github-workflows/.github/workflows/auto-merge.yaml@main
+    uses: conforma/github-workflows/.github/workflows/auto-merge.yaml@e049ae95d6a78c4665e88efa667981184394e913 # main
     secrets: inherit
     permissions:
       pull-requests: write
diff --git a/.github/workflows/checks-codecov.yaml b/.github/workflows/checks-codecov.yaml
index ce25adc51..2983b889d 100644
--- a/.github/workflows/checks-codecov.yaml
+++ b/.github/workflows/checks-codecov.yaml
@@ -61,7 +61,7 @@ jobs:
           cache: false
 
       - name: Check go versions
-        uses: conforma/github-workflows/golang-version-check@main
+        uses: conforma/github-workflows/golang-version-check@e049ae95d6a78c4665e88efa667981184394e913 # main
 
       - name: Show git sha and commit subject
         run: git log --oneline -n1
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 94d84b87b..10caf4e21 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -73,7 +73,7 @@ jobs:
       #     disable-telemetry: true
 
       - name: Free Disk Space (Ubuntu)
-        uses: jlumbroso/free-disk-space@main
+        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
         with:
           docker-images: false
           swap-storage: false
diff --git a/.tool-versions b/.tool-versions
index 5bc54b156..93fe5c1b5 100644
--- a/.tool-versions
+++ b/.tool-versions
@@ -1 +1 @@
-golang 1.26.4
+golang 1.26.7
diff --git a/Dockerfile b/Dockerfile
index ec621dc45..8dfc23c48 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -16,7 +16,7 @@
 
 ## Build
 
-FROM docker.io/library/golang:1.26.4 AS build
+FROM docker.io/library/golang:1.26.7 AS build
 
 ARG TARGETOS
 ARG TARGETARCH
diff --git a/Dockerfile.dist b/Dockerfile.dist
index 32a04a137..44949a763 100644
--- a/Dockerfile.dist
+++ b/Dockerfile.dist
@@ -16,7 +16,7 @@
 
 ## Build
 
-FROM registry.access.redhat.com/ubi9/go-toolset:1.26.4@sha256:9748bb0b8e3376e9b155a4db3fbdfbfd20057b449ea9b3aed367b2f967cdfe1b AS build
+FROM registry.access.redhat.com/ubi9/go-toolset:1.26.7@sha256:5e68f09a652ac6627a83c57655e42e24575efb278b54336039c9308607fc6b21 AS build
 
 ARG TARGETOS
 ARG TARGETARCH
diff --git a/acceptance/go.mod b/acceptance/go.mod
index b2a49dfb1..23d350ed7 100644
--- a/acceptance/go.mod
+++ b/acceptance/go.mod
@@ -1,6 +1,6 @@
 module github.com/conforma/cli/acceptance
 
-go 1.26.4
+go 1.26.7
 
 require (
 	cuelang.org/go v0.15.1
diff --git a/go.mod b/go.mod
index 205292176..a7992e4f8 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/conforma/cli
 
-go 1.26.4
+go 1.26.7
 
 require (
 	cuelang.org/go v0.16.0
diff --git a/tools/go.mod b/tools/go.mod
index c807869c5..249a5f769 100644
--- a/tools/go.mod
+++ b/tools/go.mod
@@ -1,6 +1,6 @@
 module github.com/conforma/cli/tools
 
-go 1.26.4
+go 1.26.7
 
 require (
 	github.com/daixiang0/gci v0.13.7
diff --git a/tools/kubectl/go.mod b/tools/kubectl/go.mod
index 723cabcbb..ebf3803de 100644
--- a/tools/kubectl/go.mod
+++ b/tools/kubectl/go.mod
@@ -1,6 +1,6 @@
 module github.com/conforma/cli/tools/kubectl
 
-go 1.26.4
+go 1.26.7
 
 require k8s.io/kubernetes v1.34.3