diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index d0da9da..b926cef 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -1,44 +1,35 @@
 name: "build"
 on: [push, pull_request]
-
 jobs:
   build:
     name: build
     runs-on: ubuntu-latest
     steps:
       - name: Checkout BATS
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: bats-core/bats-core
           ref: v1.11.0
-
       - name: Setup BATS
         run: |
           sudo ./install.sh /usr/local
-
       - name: Check out code
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Run tests
         run: bats test
-
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 18
-
       - run: npm ci
-
       - name: Install Hadolint
         run: |
           wget -O hadolint https://github.com/hadolint/hadolint/releases/download/v2.12.0/hadolint-Linux-x86_64
           echo "56de6d5e5ec427e17b74fa48d51271c7fc0d61244bf5c90e828aab8362d55010  hadolint" | sha256sum --check
           sudo mv hadolint /usr/local/bin/hadolint
           sudo chmod +x /usr/local/bin/hadolint
-
       - name: Run Hadolint
         run: |
           hadolint Dockerfile
-
       - name: Check if README is up-to-date
         run: |
           npm run docs
diff --git a/.github/workflows/fossa.yml b/.github/workflows/fossa.yml
index 3ceed81..fc0e67a 100644
--- a/.github/workflows/fossa.yml
+++ b/.github/workflows/fossa.yml
@@ -1,34 +1,29 @@
 name: FOSSA Scanning
-
 on:
   push:
     branches: ["main", "master", "release/**"]
   workflow_dispatch:
-
 permissions:
   contents: read
   id-token: write
-
 jobs:
   fossa-scanning:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-    - name: Checkout
-      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
-
-    # The FOSSA token is shared between all repos in NeuVector's GH org. It can
-    # be used directly and there is no need to request specific access to EIO.
-    - name: Read FOSSA token
-      uses: rancher-eio/read-vault-secrets@7282bf97898cd1c16c89f837e0bb442e6d384c89 # v3
-      with:
-        secrets: |
-          secret/data/github/org/neuvector/fossa/credentials token | FOSSA_API_KEY_PUSH_ONLY
-
-    - name: FOSSA scan
-      uses: fossas/fossa-action@c414b9ad82eaad041e47a7cf62a4f02411f427a0 # v1.8.0
-      with:
-        api-key: ${{ env.FOSSA_API_KEY_PUSH_ONLY }}
-        # Only runs the scan and do not provide/returns any results back to the
-        # pipeline.
-        run-tests: false
+      - name: Checkout
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      # The FOSSA token is shared between all repos in NeuVector's GH org. It can
+      # be used directly and there is no need to request specific access to EIO.
+      - name: Read FOSSA token
+        uses: rancher-eio/read-vault-secrets@0da85151ad1f19ed7986c41587e45aac1ace74b6 # v3
+        with:
+          secrets: |
+            secret/data/github/org/neuvector/fossa/credentials token | FOSSA_API_KEY_PUSH_ONLY
+      - name: FOSSA scan
+        uses: fossas/fossa-action@29693cc50323968e039056be419b32989fc5880c # v2.0.0
+        with:
+          api-key: ${{ env.FOSSA_API_KEY_PUSH_ONLY }}
+          # Only runs the scan and do not provide/returns any results back to the
+          # pipeline.
+          run-tests: false