diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 877f064..d3f698b 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -22,7 +22,7 @@ jobs:
       contents: write
       id-token: write  # JFrog OIDC
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 (pin)
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 (pin)
       - name: Configure JFrog npm registry (OIDC)
         uses: ./.github/actions/setup-jfrog
         with:
@@ -30,7 +30,7 @@ jobs:
           configure-pip: 'false'
           configure-uv: 'false'
           configure-terraform: 'false'
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 (pin)
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v4 (pin)
         with:
           node-version: "20"
           cache: "npm"
@@ -49,7 +49,7 @@ jobs:
           APPLE_APP_SPECIFIC_PASSWORD: ${{ secrets.APPLE_APP_SPECIFIC_PASSWORD }}
           APPLE_TEAM_ID: ${{ secrets.APPLE_TEAM_ID }}
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2 (pin)
+      - uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v2 (pin)
         if: startsWith(github.ref, 'refs/tags/v')
         with:
           files: |
@@ -63,7 +63,7 @@ jobs:
       contents: write
       id-token: write  # JFrog OIDC
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 (pin)
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 (pin)
       - name: Configure JFrog npm registry (OIDC)
         uses: ./.github/actions/setup-jfrog
         with:
@@ -71,7 +71,7 @@ jobs:
           configure-pip: 'false'
           configure-uv: 'false'
           configure-terraform: 'false'
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 (pin)
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v4 (pin)
         with:
           node-version: "20"
           cache: "npm"
@@ -81,7 +81,7 @@ jobs:
       - run: npm run build:win
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2 (pin)
+      - uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v2 (pin)
         if: startsWith(github.ref, 'refs/tags/v')
         with:
           files: dist/*.exe
@@ -95,7 +95,7 @@ jobs:
       contents: write
       id-token: write  # JFrog OIDC
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 (pin)
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 (pin)
       - name: Configure JFrog npm registry (OIDC)
         uses: ./.github/actions/setup-jfrog
         with:
@@ -103,7 +103,7 @@ jobs:
           configure-pip: 'false'
           configure-uv: 'false'
           configure-terraform: 'false'
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 (pin)
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v4 (pin)
         with:
           node-version: "20"
           cache: "npm"
@@ -113,7 +113,7 @@ jobs:
       - run: npm run build:linux
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2 (pin)
+      - uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v2 (pin)
         if: startsWith(github.ref, 'refs/tags/v')
         with:
           files: dist/*.AppImage
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index 608371f..1b09e8b 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -23,7 +23,7 @@ jobs:
       contents: read
       id-token: write  # JFrog OIDC
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 (pin)
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 (pin)
       - name: Configure JFrog npm registry (OIDC)
         uses: ./.github/actions/setup-jfrog
         with:
@@ -31,7 +31,7 @@ jobs:
           configure-pip: 'false'
           configure-uv: 'false'
           configure-terraform: 'false'
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 (pin)
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v4 (pin)
         with:
           node-version: "20"
           cache: "npm"
@@ -52,7 +52,7 @@ jobs:
       contents: read
       id-token: write  # JFrog OIDC
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 (pin)
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 (pin)
       - name: Configure JFrog npm registry (OIDC)
         uses: ./.github/actions/setup-jfrog
         with:
@@ -60,7 +60,7 @@ jobs:
           configure-pip: 'false'
           configure-uv: 'false'
           configure-terraform: 'false'
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 (pin)
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v4 (pin)
         with:
           node-version: "20"
           cache: "npm"
@@ -82,7 +82,7 @@ jobs:
       contents: read
       id-token: write  # JFrog OIDC
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4 (pin)
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v4 (pin)
       - name: Configure JFrog npm registry (OIDC)
         uses: ./.github/actions/setup-jfrog
         with:
@@ -90,7 +90,7 @@ jobs:
           configure-pip: 'false'
           configure-uv: 'false'
           configure-terraform: 'false'
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4 (pin)
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v4 (pin)
         with:
           node-version: "20"
           cache: "npm"
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 59ec941..4c4d7bc 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -19,7 +19,7 @@ jobs:
       contents: write
       pull-requests: write
     steps:
-      - uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4 (pin)
+      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v4 (pin)
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           config-file: release-please-config.json