diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index ac4d073..85dccb6 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -28,14 +28,14 @@ jobs:
     steps:
       - name: Checkout repository
         # Pin the action to an immutable commit to reduce supply-chain risk.
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
 
       - name: Initialize CodeQL
         # Pin the action to an immutable commit to reduce supply-chain risk.
-        uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225
+        uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a
         with:
           languages: ${{ matrix.language }}
 
       - name: Analyze
         # Pin the action to an immutable commit to reduce supply-chain risk.
-        uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225
+        uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index d48427a..ad9257a 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
 
       - name: Setup pnpm
         uses: pnpm/action-setup@6e7bdbda5fe05107efc88b23b7ed00aa05f84ca0
@@ -27,7 +27,7 @@ jobs:
           version: 10.32.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
         with:
           # pnpm 10.32.1 requires Node >= 22.13 (it loads node:sqlite); the
           # deployed runtime stays Node 20 via Vercel / package.json engines.
diff --git a/.github/workflows/sync-vercel-project-settings.yml b/.github/workflows/sync-vercel-project-settings.yml
index 215e46d..e953093 100644
--- a/.github/workflows/sync-vercel-project-settings.yml
+++ b/.github/workflows/sync-vercel-project-settings.yml
@@ -18,11 +18,11 @@ jobs:
     steps:
       - name: Checkout repository
         # Pin the action to an immutable commit to reduce supply-chain risk.
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
 
       - name: Setup Node.js
         # Pin the action to an immutable commit to reduce supply-chain risk.
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
         with:
           node-version: "20"
 
diff --git a/.github/workflows/update-screenshots.yml b/.github/workflows/update-screenshots.yml
index 9a56dfb..a40742b 100644
--- a/.github/workflows/update-screenshots.yml
+++ b/.github/workflows/update-screenshots.yml
@@ -24,7 +24,7 @@ jobs:
     steps:
       - name: Checkout repository
         # Pin the action to an immutable commit to reduce supply-chain risk.
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
         with:
           fetch-depth: 0
           # Authenticate git with the PR-creation PAT so the screenshot branch
@@ -37,7 +37,7 @@ jobs:
 
       - name: Setup Node.js
         # Pin the action to an immutable commit to reduce supply-chain risk.
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020
         with:
           node-version: '20'