diff --git a/.github/actionlint.yml b/.github/actionlint.yml
index 8c3822ba8b..da96a15630 100644
--- a/.github/actionlint.yml
+++ b/.github/actionlint.yml
@@ -22,3 +22,15 @@ paths:
     ignore:
       # https://github.com/rhysd/actionlint/issues/657
       - 'unexpected key "queue" for "concurrency" section.+'
+  .github/workflows/release-master.yml:
+    ignore:
+      # https://github.com/rhysd/actionlint/issues/711
+      - 'reusable workflow call .+ at "uses" is not following the format.+'
+  .github/workflows/release-nightly.yml:
+    ignore:
+      # https://github.com/rhysd/actionlint/issues/711
+      - 'reusable workflow call .+ at "uses" is not following the format.+'
+  .github/workflows/release.yml:
+    ignore:
+      # https://github.com/rhysd/actionlint/issues/711
+      - 'reusable workflow call .+ at "uses" is not following the format.+'
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 327eb5aa74..94c94c462a 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -265,7 +265,7 @@ jobs:
 
       - name: Set up QEMU
         if: matrix.qemu_platform
-        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8  # v4.2.0
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1  # v4.4.0
         with:
           image: tonistiigi/binfmt:qemu-v10.0.4-56@sha256:30cc9a4d03765acac9be2ed0afc23af1ad018aed2c28ea4be8c2eb9afe03fbd1
           cache-image: false
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 0226568fd7..74ae8547c6 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -36,12 +36,12 @@ jobs:
         persist-credentials: false
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd  # v4.37.7
+      uses: github/codeql-action/init@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2
       with:
         languages: ${{ matrix.language }}
         build-mode: none
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@ff2f1c621b7f889edc0d3c761ac2e6a3f8cdb0dd  # v4.37.7
+      uses: github/codeql-action/analyze@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2  # v4.38.2
       with:
         category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/release-master.yml b/.github/workflows/release-master.yml
index 0837c3b872..f9d1161fd1 100644
--- a/.github/workflows/release-master.yml
+++ b/.github/workflows/release-master.yml
@@ -24,7 +24,7 @@ jobs:
     permissions:
       contents: write  # May be needed to publish release
       id-token: write  # Needed for trusted publishing
-    uses: ./.github/workflows/release.yml
+    uses: $/.github/workflows/release.yml
     with:
       prerelease: true
       source: ${{ (github.repository != 'yt-dlp/yt-dlp' && vars.MASTER_ARCHIVE_REPO) || 'master' }}
diff --git a/.github/workflows/release-nightly.yml b/.github/workflows/release-nightly.yml
index ce63e20009..e0538c7476 100644
--- a/.github/workflows/release-nightly.yml
+++ b/.github/workflows/release-nightly.yml
@@ -77,7 +77,7 @@ jobs:
     permissions:
       contents: write  # May be needed to publish release
       id-token: write  # Needed for trusted publishing
-    uses: ./.github/workflows/release.yml
+    uses: $/.github/workflows/release.yml
     with:
       prerelease: true
       source: ${{ (github.repository != 'yt-dlp/yt-dlp' && vars.NIGHTLY_ARCHIVE_REPO) || 'nightly' }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4ffef69423..c6884b6629 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -155,7 +155,7 @@ jobs:
     needs: [prepare]
     permissions:
       contents: read
-    uses: ./.github/workflows/build.yml
+    uses: $/.github/workflows/build.yml
     with:
       version: ${{ needs.prepare.outputs.version }}
       channel: ${{ needs.prepare.outputs.channel }}
diff --git a/.github/workflows/test-workflows.yml b/.github/workflows/test-workflows.yml
index e8c5183174..a074dee324 100644
--- a/.github/workflows/test-workflows.yml
+++ b/.github/workflows/test-workflows.yml
@@ -83,7 +83,7 @@ jobs:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054  # v0.6.2
+        uses: zizmorcore/zizmor-action@cc914d7f3750a2d13d75c7f184a1060aa0e9d482  # v0.6.4
         with:
           advanced-security: false
           persona: pedantic