diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 7890712..ab02551 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -38,9 +38,9 @@ jobs:
     if: needs.release-check.outputs.is-release != ''
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@v6.0.3
     - name: Install nix
-      uses: cachix/install-nix-action@96951a368ba55167b55f1c916f7d416bac6505fe # v31.10.3
+      uses: cachix/install-nix-action@8aa03977d8d733052d78f4e008a241fd1dbf36b3 # v31.10.6
       with:
         nix_path: "${{ matrix.nixPath }}"
         extra_nix_config: |
@@ -73,7 +73,7 @@ jobs:
         git config --global url.https://${{ secrets.NUR_PAT }}@github.com/.insteadOf https://github.com/
 
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@v6.0.3
       with:
         token: ${{ secrets.NUR_PAT }}
 
diff --git a/.github/workflows/test-commit-push.yml b/.github/workflows/test-commit-push.yml
index c3460c5..ae64df8 100644
--- a/.github/workflows/test-commit-push.yml
+++ b/.github/workflows/test-commit-push.yml
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v6.0.3
 
     - name: Setup bot SSH signing key
       uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555 # v0.10.0
@@ -30,7 +30,7 @@ jobs:
         git commit --allow-empty -m "Test: empty commit from CI"
 
     - name: Push changes
-      uses: ad-m/github-push-action@77c5b412c50b723d2a4fbc6d71fb5723bcd439aa # v1.0.0
+      uses: ad-m/github-push-action@881a6320fdb16eb5318c5054f31c218aec2b324c # v1.3.0
       with:
         github_token: ${{ secrets.PAT }}
         branch: 'main'
diff --git a/.github/workflows/test-pat-push.yml b/.github/workflows/test-pat-push.yml
index f3c4b2d..c5f05b6 100644
--- a/.github/workflows/test-pat-push.yml
+++ b/.github/workflows/test-pat-push.yml
@@ -13,7 +13,7 @@ jobs:
         git config --global url.https://${{ secrets.NUR_PAT }}@github.com/.insteadOf https://github.com/
 
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@v6.0.3
       with:
         token: ${{ secrets.NUR_PAT }}