diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 333e45a..ced8a4d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,7 +32,7 @@ jobs:
           --health-interval 2s
           --health-retries 30
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: dtolnay/rust-toolchain@stable
         with:
           components: rustfmt, clippy
@@ -52,7 +52,7 @@ jobs:
       run:
         working-directory: ui
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: actions/setup-node@v7
         with:
           node-version: 22
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 76448f8..ca21d6d 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -46,11 +46,11 @@ jobs:
       id-token: write # exchange for the Claude GitHub App's short-lived token
       actions: read # read CI results on PRs
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 1
 
-      - uses: anthropics/claude-code-action@d70510b174a1244958df0b03166a54912811f3e6 # v1
+      - uses: anthropics/claude-code-action@61a9c274fa7110a66dfafc1bbbced03833eb25fe # v1
         with:
           claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
           include_comments_by_actor: "Castor-o7,claude[bot]"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6935e0a..a8d597d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -15,7 +15,7 @@ jobs:
   bundle:
     runs-on: ubuntu-24.04-arm
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0 # git describe needs the tags
       - uses: actions/setup-node@v7
@@ -35,7 +35,7 @@ jobs:
     needs: bundle
     runs-on: ubuntu-24.04-arm
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: actions/download-artifact@v8
         with:
           name: bundle