diff --git a/.github/workflows/bundle-is-fresh.yml b/.github/workflows/bundle-is-fresh.yml
index 6d0f9a71..d4afa0a3 100644
--- a/.github/workflows/bundle-is-fresh.yml
+++ b/.github/workflows/bundle-is-fresh.yml
@@ -14,12 +14,12 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version-file: .node-version
           cache: npm
diff --git a/.github/workflows/conventional-commits.yaml b/.github/workflows/conventional-commits.yaml
index 945ad94f..260a1f1a 100644
--- a/.github/workflows/conventional-commits.yaml
+++ b/.github/workflows/conventional-commits.yaml
@@ -17,7 +17,7 @@ jobs:
     name: Validate PR title
     runs-on: ubuntu-24.04
     steps:
-      - uses: benhodgson87/conventional-pull-request-action@0934412ade38453193a02fdfdf5c57e4f3b45c75 # v1.2.0
+      - uses: benhodgson87/conventional-pull-request-action@5cc233b5bbe95b3293e9e464ded984ed47755abe # v2.0.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
diff --git a/.github/workflows/lint-and-test.yml b/.github/workflows/lint-and-test.yml
index 9ca3bcc0..edc33138 100644
--- a/.github/workflows/lint-and-test.yml
+++ b/.github/workflows/lint-and-test.yml
@@ -9,13 +9,13 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
           show-progress: false
 
       - name: Setup Node.js
-        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7
         with:
           node-version-file: .node-version
           cache: npm
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 0d54a6f4..130add80 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -33,7 +33,7 @@ jobs:
 
       # persist-credentials must stay enabled: the tag step below pushes to `origin`
       # using the credentials this checkout writes into .git/config.
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         if: ${{ steps.release.outputs.release_created }}
       - name: Tag Major and Minor versions
         if: ${{ steps.release.outputs.release_created }}