diff --git a/.github/workflows/auto-merge.yaml b/.github/workflows/auto-merge.yaml
index bd7ad08cf..ea19c33d8 100644
--- a/.github/workflows/auto-merge.yaml
+++ b/.github/workflows/auto-merge.yaml
@@ -22,7 +22,7 @@ name: 'Auto merge'
 
 jobs:
   auto-merge:
-    uses: conforma/github-workflows/.github/workflows/auto-merge.yaml@main
+    uses: conforma/github-workflows/.github/workflows/auto-merge.yaml@e049ae95d6a78c4665e88efa667981184394e913 # main
     secrets: inherit
     permissions:
       pull-requests: write
diff --git a/.github/workflows/checks-codecov.yaml b/.github/workflows/checks-codecov.yaml
index dab13ed36..074f73033 100644
--- a/.github/workflows/checks-codecov.yaml
+++ b/.github/workflows/checks-codecov.yaml
@@ -61,7 +61,7 @@ jobs:
           cache: false
 
       - name: Check go versions
-        uses: conforma/github-workflows/golang-version-check@main
+        uses: conforma/github-workflows/golang-version-check@e049ae95d6a78c4665e88efa667981184394e913 # main
 
       - name: Show git sha and commit subject
         run: git log --oneline -n1
diff --git a/.github/workflows/label-pr-size.yaml b/.github/workflows/label-pr-size.yaml
index 9df05b5cd..bf922d28f 100644
--- a/.github/workflows/label-pr-size.yaml
+++ b/.github/workflows/label-pr-size.yaml
@@ -29,4 +29,4 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Label PR by size
-        uses: conforma/pr-size-label-action@v1.0.0
+        uses: conforma/pr-size-label-action@8b1fcdb87ab3ef4b79f9708fedf686904375e2d3 # v1.0.0
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 0be9e971b..a06ec9087 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -73,7 +73,7 @@ jobs:
       #     disable-telemetry: true
 
       - name: Free Disk Space (Ubuntu)
-        uses: jlumbroso/free-disk-space@main
+        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
         with:
           docker-images: false
           swap-storage: false
diff --git a/.tool-versions b/.tool-versions
index 5bc54b156..93fe5c1b5 100644
--- a/.tool-versions
+++ b/.tool-versions
@@ -1 +1 @@
-golang 1.26.4
+golang 1.26.7
diff --git a/Dockerfile b/Dockerfile
index fc546e1a0..0c3832f68 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -16,7 +16,7 @@
 
 ## Build
 
-FROM docker.io/library/golang:1.26.4 AS build
+FROM docker.io/library/golang:1.26.7 AS build
 
 ARG TARGETOS
 ARG TARGETARCH
diff --git a/Dockerfile.dist b/Dockerfile.dist
index 8c36cd910..ba372dd2e 100644
--- a/Dockerfile.dist
+++ b/Dockerfile.dist
@@ -16,7 +16,7 @@
 
 ## Build
 
-FROM registry.access.redhat.com/ubi9/go-toolset:1.26.4@sha256:9748bb0b8e3376e9b155a4db3fbdfbfd20057b449ea9b3aed367b2f967cdfe1b AS build
+FROM registry.access.redhat.com/ubi9/go-toolset:1.26.7@sha256:5e68f09a652ac6627a83c57655e42e24575efb278b54336039c9308607fc6b21 AS build
 
 ARG TARGETOS
 ARG TARGETARCH
diff --git a/acceptance/go.mod b/acceptance/go.mod
index 9e7b24964..e853ca10e 100644
--- a/acceptance/go.mod
+++ b/acceptance/go.mod
@@ -1,6 +1,6 @@
 module github.com/conforma/cli/acceptance
 
-go 1.26.4
+go 1.26.7
 
 require (
 	cuelang.org/go v0.16.0
diff --git a/features/ta_task_validate_image.feature b/features/ta_task_validate_image.feature
index 37f31e5ec..b0e5337c3 100644
--- a/features/ta_task_validate_image.feature
+++ b/features/ta_task_validate_image.feature
@@ -25,8 +25,8 @@ Feature: Verify Conforma Trusted Artifact Tekton Task
         "sources": [
           {
             "policy": [
-              "git::github.com/conforma/policy//policy/release?ref=release-v0.8",
-              "git::github.com/conforma/policy//policy/lib?ref=release-v0.8"
+              "git::github.com/conforma/policy//policy/release?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a",
+              "git::github.com/conforma/policy//policy/lib?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a"
             ],
             "config": {
               "include": [
@@ -65,7 +65,7 @@ Feature: Verify Conforma Trusted Artifact Tekton Task
     When version 0.1 of the task named "verify-conforma-konflux-ta" is run with parameters:
       | SNAPSHOT_FILENAME       | snapshotartifact                                                                                                                                                                                                                                                                                                                                                                                          |
       | SOURCE_DATA_ARTIFACT    | oci:${REGISTRY}/acceptance/snapshotartifact@${BUILD_SNAPSHOT_DIGEST}                                                                                                                                                                                                                                                                                                                                     |
-      | POLICY_CONFIGURATION    | {"publicKey":"-----BEGIN PUBLIC KEY-----\\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAERhr8Zj4dZW67zucg8fDr11M4lmRp\\nzN6SIcIjkvH39siYg1DkCoa2h2xMUZ10ecbM3/ECqvBV55YwQ2rcIEa7XQ==\\n-----END PUBLIC KEY-----","sources":[{"policy":["git::github.com/conforma/policy//policy/release?ref=release-v0.8","git::github.com/conforma/policy//policy/lib?ref=release-v0.8"],"config":{"include":["slsa_provenance_available"]}}]} |
+      | POLICY_CONFIGURATION    | {"publicKey":"-----BEGIN PUBLIC KEY-----\\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAERhr8Zj4dZW67zucg8fDr11M4lmRp\\nzN6SIcIjkvH39siYg1DkCoa2h2xMUZ10ecbM3/ECqvBV55YwQ2rcIEa7XQ==\\n-----END PUBLIC KEY-----","sources":[{"policy":["git::github.com/conforma/policy//policy/release?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a","git::github.com/conforma/policy//policy/lib?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a"],"config":{"include":["slsa_provenance_available"]}}]} |
       | STRICT                  | true                                                                                                                                                                                                                                                                                                                                                                                                      |
       | IGNORE_REKOR            | true                                                                                                                                                                                                                                                                                                                                                                                                      |
       | ENABLE_VSA              | true                                                                                                                                                                                                                                                                                                                                                                                                      |
@@ -90,7 +90,7 @@ Feature: Verify Conforma Trusted Artifact Tekton Task
     When version 0.1 of the task named "verify-conforma-konflux-ta" is run with parameters:
       | SNAPSHOT_FILENAME       | snapshotartifact                                                                                    |
       | SOURCE_DATA_ARTIFACT    | oci:${REGISTRY}/acceptance/snapshotartifact@${BUILD_SNAPSHOT_DIGEST} |
-      | POLICY_CONFIGURATION    | {"publicKey":"-----BEGIN PUBLIC KEY-----\\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAERhr8Zj4dZW67zucg8fDr11M4lmRp\\nzN6SIcIjkvH39siYg1DkCoa2h2xMUZ10ecbM3/ECqvBV55YwQ2rcIEa7XQ==\\n-----END PUBLIC KEY-----","sources":[{"policy":["git::github.com/conforma/policy//policy/release?ref=release-v0.8","git::github.com/conforma/policy//policy/lib?ref=release-v0.8"],"config":{"include":["slsa_provenance_available"]}}]} |
+      | POLICY_CONFIGURATION    | {"publicKey":"-----BEGIN PUBLIC KEY-----\\nMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAERhr8Zj4dZW67zucg8fDr11M4lmRp\\nzN6SIcIjkvH39siYg1DkCoa2h2xMUZ10ecbM3/ECqvBV55YwQ2rcIEa7XQ==\\n-----END PUBLIC KEY-----","sources":[{"policy":["git::github.com/conforma/policy//policy/release?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a","git::github.com/conforma/policy//policy/lib?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a"],"config":{"include":["slsa_provenance_available"]}}]} |
       | STRICT                  | true                                                                                                     |
       | IGNORE_REKOR            | true                                                                                                     |
       | TRUSTED_ARTIFACTS_DEBUG | "true"                                                                                                   |
diff --git a/features/task_validate_image.feature b/features/task_validate_image.feature
index 73b11e2e3..8e7722157 100644
--- a/features/task_validate_image.feature
+++ b/features/task_validate_image.feature
@@ -16,8 +16,8 @@ Feature: Verify Enterprise Contract Tekton Tasks
         "sources": [
           {
             "policy": [
-              "github.com/conforma/policy//policy/release?ref=release-v0.8",
-              "github.com/conforma/policy//policy/lib?ref=release-v0.8"
+              "github.com/conforma/policy//policy/release?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a",
+              "github.com/conforma/policy//policy/lib?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a"
             ],
             "config": {
               "include": [
@@ -47,8 +47,8 @@ Feature: Verify Enterprise Contract Tekton Tasks
         "sources": [
           {
             "policy": [
-              "github.com/conforma/policy//policy/release?ref=release-v0.8",
-              "github.com/conforma/policy//policy/lib?ref=release-v0.8"
+              "github.com/conforma/policy//policy/release?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a",
+              "github.com/conforma/policy//policy/lib?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a"
             ],
             "config": {
               "include": [
@@ -78,8 +78,8 @@ Feature: Verify Enterprise Contract Tekton Tasks
         "sources": [
           {
             "policy": [
-              "github.com/conforma/policy//policy/release?ref=release-v0.8",
-              "github.com/conforma/policy//policy/lib?ref=release-v0.8"
+              "github.com/conforma/policy//policy/release?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a",
+              "github.com/conforma/policy//policy/lib?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a"
             ],
             "config": {
               "include": [
@@ -110,8 +110,8 @@ Feature: Verify Enterprise Contract Tekton Tasks
         "sources": [
           {
             "policy": [
-              "github.com/conforma/policy//policy/release?ref=release-v0.8",
-              "github.com/conforma/policy//policy/lib?ref=release-v0.8"
+              "github.com/conforma/policy//policy/release?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a",
+              "github.com/conforma/policy//policy/lib?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a"
             ],
             "config": {
               "include": [
@@ -147,8 +147,8 @@ Feature: Verify Enterprise Contract Tekton Tasks
         "sources": [
           {
             "policy": [
-              "github.com/conforma/policy//policy/release?ref=release-v0.8",
-              "github.com/conforma/policy//policy/lib?ref=release-v0.8"
+              "github.com/conforma/policy//policy/release?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a",
+              "github.com/conforma/policy//policy/lib?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a"
             ],
             "config": {
               "include": [
@@ -182,8 +182,8 @@ Feature: Verify Enterprise Contract Tekton Tasks
         "sources": [
           {
             "policy": [
-              "github.com/conforma/policy//policy/release?ref=release-v0.8",
-              "github.com/conforma/policy//policy/lib?ref=release-v0.8"
+              "github.com/conforma/policy//policy/release?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a",
+              "github.com/conforma/policy//policy/lib?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a"
             ],
             "config": {
               "include": [
@@ -356,8 +356,8 @@ Feature: Verify Enterprise Contract Tekton Tasks
         "sources": [
           {
             "policy": [
-              "github.com/conforma/policy//policy/release?ref=release-v0.8",
-              "github.com/conforma/policy//policy/lib?ref=release-v0.8"
+              "github.com/conforma/policy//policy/release?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a",
+              "github.com/conforma/policy//policy/lib?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a"
             ],
             "config": {
               "include": [
@@ -389,8 +389,8 @@ Feature: Verify Enterprise Contract Tekton Tasks
         "sources": [
           {
             "policy": [
-              "github.com/conforma/policy//policy/release?ref=release-v0.8",
-              "github.com/conforma/policy//policy/lib?ref=release-v0.8"
+              "github.com/conforma/policy//policy/release?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a",
+              "github.com/conforma/policy//policy/lib?ref=b1f08f104e7678a8f40ed792e40c0799c1198e7a"
             ],
             "config": {
               "include": [
diff --git a/go.mod b/go.mod
index ef0333bc6..70b4f7a2c 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/conforma/cli
 
-go 1.26.4
+go 1.26.7
 
 require (
 	cuelang.org/go v0.16.0
diff --git a/tools/go.mod b/tools/go.mod
index 8ecf623a8..807aaace0 100644
--- a/tools/go.mod
+++ b/tools/go.mod
@@ -1,6 +1,6 @@
 module github.com/conforma/cli/tools
 
-go 1.26.4
+go 1.26.7
 
 require (
 	github.com/daixiang0/gci v0.13.7
diff --git a/tools/kubectl/go.mod b/tools/kubectl/go.mod
index ef8d834b4..08efeb217 100644
--- a/tools/kubectl/go.mod
+++ b/tools/kubectl/go.mod
@@ -1,6 +1,6 @@
 module github.com/conforma/cli/tools/kubectl
 
-go 1.26.4
+go 1.26.7
 
 require k8s.io/kubernetes v1.34.2