diff --git a/.github/workflows/autoApproveSync.yml b/.github/workflows/autoApproveSync.yml
index c215be0b3..123b6821f 100644
--- a/.github/workflows/autoApproveSync.yml
+++ b/.github/workflows/autoApproveSync.yml
@@ -26,7 +26,7 @@ permissions:
 jobs:
   auto-approve:
     name: Auto approve sync
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-low
     if: ${{ contains(github.event.pull_request.labels.*.name, 'sync') && github.actor == 'nextcloud-android-bot' }}
     steps:
       - name: Disabled on forks
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 9683c0579..71e86ec8b 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -43,7 +43,7 @@ jobs:
         with:
           swap-size-gb: 10
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           languages: ${{ matrix.language }}
       - name: Set up JDK 21
@@ -57,4 +57,4 @@ jobs:
           echo "org.gradle.jvmargs=-Xmx4g -XX:MaxMetaspaceSize=512m -XX:+HeapDumpOnOutOfMemoryError" > "$HOME/.gradle/gradle.properties"
           ./gradlew --no-daemon assembleDebug
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
diff --git a/.github/workflows/detectNewJavaFiles.yml b/.github/workflows/detectNewJavaFiles.yml
index 908e3fd28..8bcb9720d 100644
--- a/.github/workflows/detectNewJavaFiles.yml
+++ b/.github/workflows/detectNewJavaFiles.yml
@@ -20,7 +20,7 @@ concurrency:
 
 jobs:
   detectNewJavaFiles:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-low
     steps:
       - id: file_changes
         uses: trilom/file-changes-action@a6ca26c14274c33b15e6499323aac178af06ad4b # v1.2.4
diff --git a/.github/workflows/pr-feedback.yml b/.github/workflows/pr-feedback.yml
index 38bfe8477..97ed0cf9d 100644
--- a/.github/workflows/pr-feedback.yml
+++ b/.github/workflows/pr-feedback.yml
@@ -22,7 +22,7 @@ permissions:
 jobs:
   pr-feedback:
     if: ${{ github.repository_owner == 'nextcloud' }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-low
     steps:
       - name: The get-github-handles-from-website action
         uses: marcelklehr/get-github-handles-from-website-action@06b2239db0a48fe1484ba0bfd966a3ab81a08308 # v1.0.1
diff --git a/.github/workflows/renovate-approve-merge.yml b/.github/workflows/renovate-approve-merge.yml
index f4307a829..507ad3697 100644
--- a/.github/workflows/renovate-approve-merge.yml
+++ b/.github/workflows/renovate-approve-merge.yml
@@ -25,7 +25,7 @@ concurrency:
 jobs:
   auto-approve-merge:
     if: github.event.pull_request.user.login == 'renovate[bot]'
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-low
     permissions:
       # for hmarr/auto-approve-action to approve PRs
       pull-requests: write
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index bbb3a2b36..b9701da20 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -42,6 +42,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 955de8ff3..e9c1f291b 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -15,7 +15,7 @@ permissions: read-all
 
 jobs:
   stale:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-latest-low
     permissions:
       issues: write
       pull-requests: write