diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index 7c51a03c..5ef8c8bc 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -34,6 +34,6 @@ jobs:
         with:
           egress-policy: audit
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: EmbarkStudios/cargo-deny-action@a531616d8ce3b9177443e48a1159bc945a099823 # v2.0.19
+      - uses: EmbarkStudios/cargo-deny-action@6c8f9facfa5047ec02d8485b6bf52b587b7777d1 # v2.0.18
         with:
           command: check advisories
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 97410f20..09b237c5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -163,7 +163,7 @@ jobs:
         with:
           egress-policy: audit
       - uses: actions/checkout@v6
-      - uses: EmbarkStudios/cargo-deny-action@v2
+      - uses: EmbarkStudios/cargo-deny-action@v2.0.18
         with:
           command: check
 
diff --git a/.github/workflows/python.yml b/.github/workflows/python.yml
index b1ad1574..e279fad4 100644
--- a/.github/workflows/python.yml
+++ b/.github/workflows/python.yml
@@ -80,7 +80,7 @@ jobs:
         with:
           egress-policy: audit
       - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v6.2.0
         with:
           python-version: ${{ matrix.python }}
       - uses: dtolnay/rust-toolchain@stable
diff --git a/.github/workflows/release-python.yml b/.github/workflows/release-python.yml
index b9ee77cc..986ed065 100644
--- a/.github/workflows/release-python.yml
+++ b/.github/workflows/release-python.yml
@@ -60,7 +60,7 @@ jobs:
       # native ubuntu-24.04-arm leg and by this job's macOS-arm64 leg.
       - name: Set up Python to test the built wheel
         if: ${{ !(matrix.platform.runner == 'ubuntu-latest' && matrix.platform.target == 'aarch64') }}
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.13"
       - name: Install the built wheel and run pytest
@@ -101,7 +101,7 @@ jobs:
         with:
           toolchain: stable
       - name: Set up Python to test the sdist
-        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.13"
       - name: Install from the sdist and run pytest