diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 613e0d031..fd5152f13 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -28,12 +28,12 @@ jobs:
             checks: write
         steps:
             - name: "\U0001F4E5 Checkout repo"
-              uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
               with:
                   persist-credentials: false
 
             - name: "⚙️ Setup node"
-              uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
               with:
                   node-version: 20
                   cache: npm
@@ -56,12 +56,12 @@ jobs:
         if: ${{ !github.event.pull_request.draft || github.event_name == 'push' }}
         steps:
             - name: "\U0001F4E5 Checkout repo"
-              uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
               with:
                   persist-credentials: false
 
             - name: "⚙️ Setup node"
-              uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
               with:
                   node-version: 20
                   cache: npm
@@ -86,12 +86,12 @@ jobs:
         if: ${{ !github.event.pull_request.draft || github.event_name == 'push' }}
         steps:
             - name: "\U0001F4E5 Checkout repo"
-              uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
               with:
                   persist-credentials: false
 
             - name: "⚙️ Setup node"
-              uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
               with:
                   node-version: 20
                   cache: npm
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 67d3aa9c6..e430c5d07 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -20,13 +20,13 @@ jobs:
 
         steps:
             - name: "\U0001F4E5 Checkout repo"
-              uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
               with:
                   persist-credentials: false
 
             # No cache — deploy builds must be hermetic
             - name: "⚙️ Setup node"
-              uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
               with:
                   node-version: 22
 
@@ -58,7 +58,7 @@ jobs:
 
         steps:
             - name: "\U0001F4E5 Checkout repo"
-              uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
               with:
                   persist-credentials: false
 
@@ -93,13 +93,13 @@ jobs:
 
         steps:
             - name: "\U0001F4E5 Checkout repo"
-              uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
               with:
                   persist-credentials: false
 
             # No cache — deploy builds must be hermetic
             - name: "⚙️ Setup node"
-              uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
               with:
                   node-version: 22
 
@@ -130,12 +130,12 @@ jobs:
 
         steps:
             - name: "\U0001F4E5 Checkout repo"
-              uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
               with:
                   persist-credentials: false
 
             - name: "⚙️ Setup node"
-              uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
               with:
                   node-version: 22
 
@@ -178,13 +178,13 @@ jobs:
 
         steps:
             - name: "\U0001F4E5 Checkout repo"
-              uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
               with:
                   persist-credentials: false
 
             # No cache — deploy builds must be hermetic
             - name: "⚙️ Setup node"
-              uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
               with:
                   node-version: 22
 
@@ -227,7 +227,7 @@ jobs:
 
         steps:
             - name: "\U0001F4E5 Checkout repo"
-              uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
               with:
                   persist-credentials: false
 
diff --git a/.github/workflows/security_zizmor.yml b/.github/workflows/security_zizmor.yml
index 1474636c0..32773fe98 100644
--- a/.github/workflows/security_zizmor.yml
+++ b/.github/workflows/security_zizmor.yml
@@ -34,12 +34,12 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@b1d7e1fb5de872772f31590499237e7cce841e8e # v0.5.3
+        uses: zizmorcore/zizmor-action@b572f7b1a1c2d41efaab43d504f68d215c3cd727 # v0.5.4
         with:
           min-severity: medium
           advanced-security: false