diff --git a/.github/workflows/ci-feedback-events.yml b/.github/workflows/ci-feedback-events.yml
index 02cea74..91fdf51 100644
--- a/.github/workflows/ci-feedback-events.yml
+++ b/.github/workflows/ci-feedback-events.yml
@@ -19,7 +19,7 @@ jobs:
     permissions:
       actions: read # Read exact completed run and job metadata.
       issues: write # Publish bounded failure evidence in this repository.
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/ci-feedback.yml@9adc78a8a79553e1002134bd4f901dc7822d25b5 # commit:9adc78a8a79553e1002134bd4f901dc7822d25b5
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/ci-feedback.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23
     with:
       run-id: ${{ format('{0}', github.event.workflow_run.id) }}
       run-attempt: ${{ format('{0}', github.event.workflow_run.run_attempt) }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index ed0fe6a..018e674 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -31,7 +31,7 @@ jobs:
       actions: read
       contents: read
       security-events: write
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7 # commit:9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/public-codeql.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23
     with:
       # Public repository: `pull_request` runs untrusted fork code. Name the
       # hosted runner explicitly — the reusable's default belongs to the pinned
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f1f44f4..99e286e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -41,7 +41,7 @@ jobs:
     permissions:
       actions: read # verify exact public workflow evidence
       contents: read # read the signed annotated tag
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/release-promotion-gate.yml@9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7 # commit:9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/release-promotion-gate.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23
     with:
       version: ${{ needs.resolve.outputs.version }}
       runner: ubuntu-latest
@@ -62,7 +62,7 @@ jobs:
       id-token: write # mint Sigstore identity
       attestations: write # persist provenance and SBOM attestations
       artifact-metadata: write # persist attested artifact metadata
-    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/release-supply-chain.yml@9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7 # commit:9eb9e070ae87b0fc3bdbd2cbed5afe3b92f7e2c7
+    uses: NDDev-OpenNetwork/ci-workflows/.github/workflows/release-supply-chain.yml@96215b32fbc751716b5c0b758a7a7ca202246574 # 0.1.23
     with:
       version: ${{ needs.resolve.outputs.version }}
       package_name: cd-workflows