diff --git a/.github/workflows/backend-ci.yml b/.github/workflows/backend-ci.yml
index 072d1a67..5b55ef8f 100644
--- a/.github/workflows/backend-ci.yml
+++ b/.github/workflows/backend-ci.yml
@@ -153,7 +153,7 @@ jobs:
       # Upload code quality SARIF reports to GitHub Security
       - name: Upload ktlint SARIF report
         if: always()
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@v4.37.3
         with:
           sarif_file: apps/api/build/reports/ktlint/ktlintMainSourceSetCheck/ktlintMainSourceSetCheck.sarif
           category: 'code-quality-ktlint'
@@ -162,7 +162,7 @@ jobs:
       # detekt SARIF upload disabled - re-enable when detekt 2.0.0 stable is released
       # - name: Upload detekt SARIF report
       #   if: always()
-      #   uses: github/codeql-action/upload-sarif@v4
+      #   uses: github/codeql-action/upload-sarif@v4.37.3
       #   with:
       #     sarif_file: apps/api/build/reports/detekt/detekt.sarif
       #     category: 'code-quality-detekt'
diff --git a/.github/workflows/frontend-ci.yml b/.github/workflows/frontend-ci.yml
index e22ab075..4869a2ac 100644
--- a/.github/workflows/frontend-ci.yml
+++ b/.github/workflows/frontend-ci.yml
@@ -190,7 +190,7 @@ jobs:
 
       - name: Setup Node.js 24
         if: ${{ steps.changes.outputs.bundle == 'true' }}
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: '24'
 
diff --git a/.github/workflows/pr-validation.yml b/.github/workflows/pr-validation.yml
index db582fd8..4bd43b01 100644
--- a/.github/workflows/pr-validation.yml
+++ b/.github/workflows/pr-validation.yml
@@ -118,7 +118,7 @@ jobs:
 
       - name: Upload SARIF results
         if: always()
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@v4.37.3
         with:
           sarif_file: 'trivy-global-results.sarif'
           category: 'security-global'
diff --git a/.github/workflows/reusable-security-scan.yml b/.github/workflows/reusable-security-scan.yml
index af7425b7..0cdde633 100644
--- a/.github/workflows/reusable-security-scan.yml
+++ b/.github/workflows/reusable-security-scan.yml
@@ -56,7 +56,7 @@ jobs:
 
       - name: Upload SARIF results
         if: always()
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@v4.37.3
         with:
           sarif_file: 'trivy-backend-results.sarif'
           category: 'security-backend'
@@ -108,7 +108,7 @@ jobs:
 
       - name: Upload SARIF results
         if: always()
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@v4.37.3
         with:
           sarif_file: 'trivy-frontend-results.sarif'
           category: 'security-frontend'
@@ -147,7 +147,7 @@ jobs:
 
       - name: Upload SARIF results
         if: always()
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@v4.37.3
         with:
           sarif_file: 'trivy-infrastructure-results.sarif'
           category: 'security-infrastructure'
@@ -193,7 +193,7 @@ jobs:
 
       # - name: Upload detekt results
       #   if: always()
-      #   uses: github/codeql-action/upload-sarif@v4
+      #   uses: github/codeql-action/upload-sarif@v4.37.3
       #   with:
       #     sarif_file: 'apps/api/build/reports/detekt/detekt.sarif'
       #     category: 'detekt-backend'
@@ -223,7 +223,7 @@ jobs:
 
       - name: Upload ESLint SARIF results
         if: always() && hashFiles('apps/web/eslint-frontend-results.sarif') != ''
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@v4.37.3
         with:
           sarif_file: 'apps/web/eslint-frontend-results.sarif'
           category: 'eslint-frontend'