diff --git a/.github/workflows/generic-amd64.yml b/.github/workflows/generic-amd64.yml
index 4cb4a3b1d8..b8981a1c70 100644
--- a/.github/workflows/generic-amd64.yml
+++ b/.github/workflows/generic-amd64.yml
@@ -19,7 +19,7 @@ jobs:
     name: Yocto
     # FIXME: This workflow has dependencies on scripts in the balena-yocto-scripts repository
     # which is pinned separately as a submodule in the device repo. Expect some drift but try to retain compatibility.
-    uses: balena-os/balena-yocto-scripts/.github/workflows/yocto-build-deploy.yml@v1.25.7
+    uses: balena-os/balena-yocto-scripts/.github/workflows/yocto-build-deploy.yml@d59fac4cce1dcff0b423ac97aeccbd7f4486b9c2 # v1.25.8
     # Prevent duplicate workflow executions for pull_request (PR) and pull_request_target (PRT) events.
     # Both PR and PRT will be triggered for the same pull request, whether it is internal or from a fork.
     # This condition will prevent the workflow from running twice for the same pull request while
diff --git a/.github/workflows/genericx86-64-ext.yml b/.github/workflows/genericx86-64-ext.yml
index 7e8985e245..c2d6e4cb5c 100644
--- a/.github/workflows/genericx86-64-ext.yml
+++ b/.github/workflows/genericx86-64-ext.yml
@@ -19,7 +19,7 @@ jobs:
     name: Yocto
     # FIXME: This workflow has dependencies on scripts in the balena-yocto-scripts repository
     # which is pinned separately as a submodule in the device repo. Expect some drift but try to retain compatibility.
-    uses: balena-os/balena-yocto-scripts/.github/workflows/yocto-build-deploy.yml@v1.25.7
+    uses: balena-os/balena-yocto-scripts/.github/workflows/yocto-build-deploy.yml@d59fac4cce1dcff0b423ac97aeccbd7f4486b9c2 # v1.25.8
     # Prevent duplicate workflow executions for pull_request (PR) and pull_request_target (PRT) events.
     # Both PR and PRT will be triggered for the same pull request, whether it is internal or from a fork.
     # This condition will prevent the workflow from running twice for the same pull request while
diff --git a/.github/workflows/genericx86-64.yml b/.github/workflows/genericx86-64.yml
index 68dac4eccf..7a76d34661 100644
--- a/.github/workflows/genericx86-64.yml
+++ b/.github/workflows/genericx86-64.yml
@@ -19,7 +19,7 @@ jobs:
     name: Yocto
     # FIXME: This workflow has dependencies on scripts in the balena-yocto-scripts repository
     # which is pinned separately as a submodule in the device repo. Expect some drift but try to retain compatibility.
-    uses: balena-os/balena-yocto-scripts/.github/workflows/yocto-build-deploy.yml@v1.25.7
+    uses: balena-os/balena-yocto-scripts/.github/workflows/yocto-build-deploy.yml@d59fac4cce1dcff0b423ac97aeccbd7f4486b9c2 # v1.25.8
     # Prevent duplicate workflow executions for pull_request (PR) and pull_request_target (PRT) events.
     # Both PR and PRT will be triggered for the same pull request, whether it is internal or from a fork.
     # This condition will prevent the workflow from running twice for the same pull request while
diff --git a/.github/workflows/raspberrypi3-64.yml b/.github/workflows/raspberrypi3-64.yml
index 7e4593f74c..499350ba94 100644
--- a/.github/workflows/raspberrypi3-64.yml
+++ b/.github/workflows/raspberrypi3-64.yml
@@ -19,7 +19,7 @@ jobs:
     name: Yocto
     # FIXME: This workflow has dependencies on scripts in the balena-yocto-scripts repository
     # which is pinned separately as a submodule in the device repo. Expect some drift but try to retain compatibility.
-    uses: balena-os/balena-yocto-scripts/.github/workflows/yocto-build-deploy.yml@v1.25.7
+    uses: balena-os/balena-yocto-scripts/.github/workflows/yocto-build-deploy.yml@d59fac4cce1dcff0b423ac97aeccbd7f4486b9c2 # v1.25.8
     # Prevent duplicate workflow executions for pull_request (PR) and pull_request_target (PRT) events.
     # Both PR and PRT will be triggered for the same pull request, whether it is internal or from a fork.
     # This condition will prevent the workflow from running twice for the same pull request while
diff --git a/.github/workflows/raspberrypi3.yml b/.github/workflows/raspberrypi3.yml
index 74b3cfacd3..1315f21356 100644
--- a/.github/workflows/raspberrypi3.yml
+++ b/.github/workflows/raspberrypi3.yml
@@ -19,7 +19,7 @@ jobs:
     name: Yocto
     # FIXME: This workflow has dependencies on scripts in the balena-yocto-scripts repository
     # which is pinned separately as a submodule in the device repo. Expect some drift but try to retain compatibility.
-    uses: balena-os/balena-yocto-scripts/.github/workflows/yocto-build-deploy.yml@v1.25.7
+    uses: balena-os/balena-yocto-scripts/.github/workflows/yocto-build-deploy.yml@d59fac4cce1dcff0b423ac97aeccbd7f4486b9c2 # v1.25.8
     # Prevent duplicate workflow executions for pull_request (PR) and pull_request_target (PRT) events.
     # Both PR and PRT will be triggered for the same pull request, whether it is internal or from a fork.
     # This condition will prevent the workflow from running twice for the same pull request while
diff --git a/.github/workflows/raspberrypi4-64.yml b/.github/workflows/raspberrypi4-64.yml
index cded51b386..5a1579c44b 100644
--- a/.github/workflows/raspberrypi4-64.yml
+++ b/.github/workflows/raspberrypi4-64.yml
@@ -19,7 +19,7 @@ jobs:
     name: Yocto
     # FIXME: This workflow has dependencies on scripts in the balena-yocto-scripts repository
     # which is pinned separately as a submodule in the device repo. Expect some drift but try to retain compatibility.
-    uses: balena-os/balena-yocto-scripts/.github/workflows/yocto-build-deploy.yml@v1.25.7
+    uses: balena-os/balena-yocto-scripts/.github/workflows/yocto-build-deploy.yml@d59fac4cce1dcff0b423ac97aeccbd7f4486b9c2 # v1.25.8
     # Prevent duplicate workflow executions for pull_request (PR) and pull_request_target (PRT) events.
     # Both PR and PRT will be triggered for the same pull request, whether it is internal or from a fork.
     # This condition will prevent the workflow from running twice for the same pull request while