diff --git a/.github/workflows/autopilot-docs-daily.yml b/.github/workflows/autopilot-docs-daily.yml
index e7addeb..a40e5c9 100644
--- a/.github/workflows/autopilot-docs-daily.yml
+++ b/.github/workflows/autopilot-docs-daily.yml
@@ -20,7 +20,7 @@ jobs:
       GH_TOKEN: ${{ secrets.ORG_READ_TOKEN || github.token }}
     steps:
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Update status docs
         run: |
diff --git a/.github/workflows/autopilot-operator.yml b/.github/workflows/autopilot-operator.yml
index d5c5f54..2f83a87 100644
--- a/.github/workflows/autopilot-operator.yml
+++ b/.github/workflows/autopilot-operator.yml
@@ -29,7 +29,7 @@ jobs:
           }
 
       - name: Checkout
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           clean: false
 
diff --git a/.github/workflows/autopilot-org-installer.yml b/.github/workflows/autopilot-org-installer.yml
index 7ae7fcd..def6381 100644
--- a/.github/workflows/autopilot-org-installer.yml
+++ b/.github/workflows/autopilot-org-installer.yml
@@ -19,7 +19,7 @@ jobs:
       GH_TOKEN: ${{ secrets.ORG_AUTOPILOT_TOKEN }}
     steps:
       - name: Checkout installer
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Sync intake workflow
         run: |
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e1d0bf9..f16d4e5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Install workflow validator dependency
         run: python -m pip install --disable-pip-version-check PyYAML==6.0.2
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 9df5df1..ad2231b 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -22,12 +22,12 @@ jobs:
         language: ['python']
     steps:
       - name: Checkout repository
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4
+        uses: github/codeql-action/init@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
         with:
           languages: ${{ matrix.language }}
       - name: Autobuild
-        uses: github/codeql-action/autobuild@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4
+        uses: github/codeql-action/autobuild@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@99df26d4f13ea111d4ec1a7dddef6063f76b97e9 # v4
+        uses: github/codeql-action/analyze@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 43cf4d7..a0e8c25 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -16,8 +16,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
-      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: 3.x
       - run: pip install mkdocs-material
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index b0a5707..ce70cd4 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10
+      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10
         with:
           days-before-stale: 60
           days-before-close: 7