diff --git a/.github/workflows/add-issue-to-project.yaml b/.github/workflows/add-issue-to-project.yaml
index 18dcd94..8fece01 100755
--- a/.github/workflows/add-issue-to-project.yaml
+++ b/.github/workflows/add-issue-to-project.yaml
@@ -14,7 +14,7 @@ jobs:
     # Generate token for GitHub app
       - name: Generate token
         id: generate-token
-        uses: actions/create-github-app-token@v1
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3
         with:
           app-id: 1008511
           private-key: ${{ secrets.CG_ISSUE_PROCESSOR_TOKEN }}
diff --git a/.github/workflows/deploy_catglobe_nupkg.yaml b/.github/workflows/deploy_catglobe_nupkg.yaml
index 002e2ec..65dcfbe 100644
--- a/.github/workflows/deploy_catglobe_nupkg.yaml
+++ b/.github/workflows/deploy_catglobe_nupkg.yaml
@@ -31,13 +31,13 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Setup .NET
-        uses: actions/setup-dotnet@3e891b0cb619bf60e2c25674b222b8940e2c1c25 # v4
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6
         with:
           dotnet-version: '10'
       - name: Setup Node.js
-        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7
         with:
           cache: npm
           cache-dependency-path: |
@@ -68,7 +68,7 @@ jobs:
           echo "failed=$failed" >> "$GITHUB_OUTPUT"
       - name: Archive test results
         if: ${{ always() && steps.unit-test-signal.outputs.failed == 'true' }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: test-reports
           path: ./test-results-output/*.trx
@@ -111,7 +111,7 @@ jobs:
           hide_classify: "OUTDATED"
           path: ./coveragereport/Summary.md
       - name: NuGet login (OIDC → temp API key)
-        uses: NuGet/login@v1
+        uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1
         id: nuget
         with:
           user: Catglobe