diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 647ecc1..6d75472 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -44,7 +44,7 @@ jobs:
           bundler-cache: true
 
       - name: Set up Deno
-        uses: denoland/setup-deno@61df2da039798545a278151ba52240239f604b71 # v2.0.2
+        uses: denoland/setup-deno@909cc5acb0fdd60627fb858598759246509fa755 # v2.0.2
         with:
           deno-version: v1.x
 
@@ -111,7 +111,7 @@ jobs:
           bundler-cache: true
 
       - name: Set up Deno
-        uses: denoland/setup-deno@61df2da039798545a278151ba52240239f604b71 # v2.0.2
+        uses: denoland/setup-deno@909cc5acb0fdd60627fb858598759246509fa755 # v2.0.2
         with:
           deno-version: v1.x
 
@@ -147,15 +147,15 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@b2f9ef845756500b97acbdaf5c1dd4e9c1d15734 # v3.31.9
+        uses: github/codeql-action/init@4bdb89f48054571735e3792627da6195c57459e2 # v3.31.9
         with:
           languages: ruby, javascript
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@b2f9ef845756500b97acbdaf5c1dd4e9c1d15734 # v3.31.9
+        uses: github/codeql-action/autobuild@4bdb89f48054571735e3792627da6195c57459e2 # v3.31.9
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@b2f9ef845756500b97acbdaf5c1dd4e9c1d15734 # v3.31.9
+        uses: github/codeql-action/analyze@4bdb89f48054571735e3792627da6195c57459e2 # v3.31.9
 
   rsr-validation:
     name: RSR Compliance Check
diff --git a/.github/workflows/gleam-ci.yml b/.github/workflows/gleam-ci.yml
index 0139723..bdfc149 100644
--- a/.github/workflows/gleam-ci.yml
+++ b/.github/workflows/gleam-ci.yml
@@ -28,7 +28,7 @@ jobs:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Setup Erlang/OTP and Gleam
-        uses: erlef/setup-beam@53eca37a5015e5c7075c3d9b4b08705001f35835 # v1.18.2
+        uses: erlef/setup-beam@5304e04ea2b355f03681464e683d92e3b2f18451 # v1.18.2
         with:
           otp-version: '26.0'
   permissions: contents: read
diff --git a/.github/workflows/rescript-deno-ci.yml b/.github/workflows/rescript-deno-ci.yml
index e04883f..ed9fcc7 100644
--- a/.github/workflows/rescript-deno-ci.yml
+++ b/.github/workflows/rescript-deno-ci.yml
@@ -9,7 +9,7 @@ jobs:
   permissions: contents: read
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: denoland/setup-deno@61df2da039798545a278151ba52240239f604b71 # v2.0.2
+      - uses: denoland/setup-deno@909cc5acb0fdd60627fb858598759246509fa755 # v2.0.2
         with:
           deno-version: v1.x
   permissions: contents: read
@@ -38,7 +38,7 @@ jobs:
   permissions: contents: read
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: denoland/setup-deno@61df2da039798545a278151ba52240239f604b71 # v2.0.2
+      - uses: denoland/setup-deno@909cc5acb0fdd60627fb858598759246509fa755 # v2.0.2
       - name: Check permissions
         run: |
           # Audit for dangerous permissions