diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7588c57..dc7ed5b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -90,31 +90,31 @@ jobs:
               with:
                 egress-policy: audit
             - name: Checkout
-              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
+              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
               with:
                 persist-credentials: false
 
             - name: Set up Go
-              uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c
+              uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
               with:
                   go-version: ${{ env.GO_VERSION }}
                   cache: true
 
             - name: Set up Node
               if: matrix.task.id == 'test' || matrix.task.id == 'bindings'
-              uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f
+              uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
               with:
                   node-version: ${{ env.NODE_VERSION }}
 
             - name: Set up Python
               if: matrix.task.id == 'bindings' || matrix.task.id == 'nomadnet'
-              uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+              uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
               with:
                   python-version: "3.12"
 
             - name: golangci-lint
               if: matrix.task.id == 'lint'
-              uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
+              uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
               with:
                   version: ${{ env.GOLANGCI_LINT_VERSION }}
                   args: --timeout=10m ./...
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 1a15c91..ff16b7b 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -46,12 +46,12 @@ jobs:
                   egress-policy: audit
 
             - name: Checkout
-              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
+              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
               with:
                   persist-credentials: false
 
             - name: Set up Go
-              uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c
+              uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
               with:
                   go-version: ${{ env.GO_VERSION }}
                   # Stdlib-only module has no go.sum; skip dependency cache.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a85bb1c..b1cac62 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -48,18 +48,18 @@ jobs:
               with:
                 egress-policy: audit
             - name: Checkout
-              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
+              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
               with:
                 persist-credentials: false
 
             - name: Set up Go
-              uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c
+              uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
               with:
                   go-version: ${{ env.GO_VERSION }}
                   cache: true
 
             - name: Set up Node
-              uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f
+              uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
               with:
                   node-version: "22"
 
@@ -107,33 +107,33 @@ jobs:
                 egress-policy: audit
 
             - name: Checkout
-              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
+              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
               with:
                 persist-credentials: false
 
             - name: Set up Go
-              uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c
+              uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
               with:
                   go-version: ${{ env.GO_VERSION }}
                   cache: false
 
             - name: Set up Python
-              uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
+              uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
               with:
                   python-version: "3.12"
 
             - name: Set up Node
-              uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f
+              uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
               with:
                   node-version: "22"
 
             - name: Set up .NET
-              uses: actions/setup-dotnet@d4c94342e560b34958eacfc5d055d21461ed1c5d # v5.0.0
+              uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
               with:
                   dotnet-version: "8.0.x"
 
             - name: Set up Java
-              uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
+              uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
               with:
                   distribution: temurin
                   java-version: "21"
@@ -158,7 +158,7 @@ jobs:
                   ./scripts/package-bindings.sh "${{ matrix.platform }}" "dist/${{ matrix.lib }}"
 
             - name: Upload platform artifacts
-              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
               with:
                   name: natives-${{ matrix.platform }}
                   path: |
@@ -178,12 +178,12 @@ jobs:
               with:
                 egress-policy: audit
             - name: Checkout
-              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
+              uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
               with:
                 persist-credentials: false
 
             - name: Set up Go
-              uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c
+              uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e
               with:
                   go-version: ${{ env.GO_VERSION }}
                   cache: true
@@ -207,7 +207,7 @@ jobs:
                   PY
 
             - name: Download native artifacts
-              uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
+              uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
               with:
                   pattern: natives-*
                   path: release-natives
@@ -230,7 +230,7 @@ jobs:
                   ls -la release-out
 
             - name: Create GitHub release
-              uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65
+              uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64
               with:
                   files: release-out/*
                   fail_on_unmatched_files: true