diff --git a/.github/workflows/app.yml b/.github/workflows/app.yml
index dde30ad7d9..d6150bf1d5 100644
--- a/.github/workflows/app.yml
+++ b/.github/workflows/app.yml
@@ -27,11 +27,11 @@ jobs:
       run:
         working-directory: app
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 2
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '22.23.2'
           cache: npm
@@ -63,11 +63,11 @@ jobs:
       run:
         working-directory: app
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 2
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '22.23.2'
           cache: npm
diff --git a/.github/workflows/no-gpu.yml b/.github/workflows/no-gpu.yml
index 9886fe8d71..511c589429 100644
--- a/.github/workflows/no-gpu.yml
+++ b/.github/workflows/no-gpu.yml
@@ -11,7 +11,7 @@ jobs:
   zig:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -48,7 +48,7 @@ jobs:
     # This fork: upstream's Windows build fails since 1.1.0 (ashhart/TensorFold#1034); the steps report, the job passes.
     # Drop continue-on-error once a sync brings upstream's Windows fix and zig-windows passes again.
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1
         with:
           version: 0.17.0
diff --git a/.github/workflows/pack-compare.yml b/.github/workflows/pack-compare.yml
index 1bd9328dee..1c03abcd41 100644
--- a/.github/workflows/pack-compare.yml
+++ b/.github/workflows/pack-compare.yml
@@ -14,10 +14,10 @@ jobs:
   pack-compare:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.14.7'
       - name: Install the comparator dependency
diff --git a/.github/workflows/zig-fmt.yml b/.github/workflows/zig-fmt.yml
index 36ab439178..cba30e8bbe 100644
--- a/.github/workflows/zig-fmt.yml
+++ b/.github/workflows/zig-fmt.yml
@@ -8,8 +8,8 @@ jobs:
   fmt:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: mlugg/setup-zig@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2.2.1
         with:
           version: 0.17.0
       # zig fmt --check fails the pull request when Zig formatting drifts.