diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 24fa082da..125b15a19 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -148,15 +148,15 @@ jobs:
       PAYPAL_CLIENT_ID_LEGACY: ${{ secrets.PAYPAL_CLIENT_ID_LEGACY }}
       PAYPAL_SECRET_LEGACY: ${{ secrets.PAYPAL_SECRET_LEGACY }}
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+        uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
         with:
           run_install: false
       - name: Setup Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: ${{ matrix.node_version }}
           cache: pnpm
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e30a759c3..b519ed1a2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -30,7 +30,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/docker-image-build-publish.yml b/.github/workflows/docker-image-build-publish.yml
index 204243383..9ce68dab0 100644
--- a/.github/workflows/docker-image-build-publish.yml
+++ b/.github/workflows/docker-image-build-publish.yml
@@ -44,17 +44,17 @@ jobs:
     steps:
       # Checkout the repository to the runner
       - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
       # Set up Docker Buildx
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       # Log into GitHub Container Registry using a GitHub token
       - name: Log into GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
diff --git a/.github/workflows/release-convert-sqlite-to-eml.yml b/.github/workflows/release-convert-sqlite-to-eml.yml
index 1cfa41804..3f26000b5 100644
--- a/.github/workflows/release-convert-sqlite-to-eml.yml
+++ b/.github/workflows/release-convert-sqlite-to-eml.yml
@@ -36,11 +36,11 @@ jobs:
         working-directory: tools/convert-sqlite-to-eml
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 22
 
@@ -76,7 +76,7 @@ jobs:
 
       - name: Upload binary to release (Linux/macOS)
         if: runner.os != 'Windows'
-        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
         with:
           files: tools/convert-sqlite-to-eml/dist/${{ matrix.artifact }}
         env:
@@ -84,7 +84,7 @@ jobs:
 
       - name: Upload binary to release (Windows)
         if: runner.os == 'Windows'
-        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3.0.1
         with:
           files: tools/convert-sqlite-to-eml/dist/${{ matrix.artifact }}.exe
         env: