diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 99b751f..3d8d001 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -31,4 +31,4 @@ jobs:
         run: composer test-with-coverage
 
       - name: Upload coverage results to Coveralls
-        uses: coverallsapp/github-action@v2
+        uses: coverallsapp/github-action@v2.3.6
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index dd16c91..63c5e74 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -23,7 +23,7 @@ jobs:
           token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
           fetch-depth: 0
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@v7
         with:
           node-version: "lts/*"
           cache: "npm"
diff --git a/.github/workflows/trivy.yml b/.github/workflows/trivy.yml
index 5f64f44..b6725d2 100644
--- a/.github/workflows/trivy.yml
+++ b/.github/workflows/trivy.yml
@@ -27,7 +27,7 @@ jobs:
           output: 'trivy-fs-results.sarif'
           severity: 'CRITICAL,HIGH'
 
-      - uses: github/codeql-action/upload-sarif@v4
+      - uses: github/codeql-action/upload-sarif@v4.37.3
         with:
           sarif_file: 'trivy-fs-results.sarif'
           category: 'filesystem-scan'