diff --git a/.github/workflows/ci-build-linux.yml b/.github/workflows/ci-build-linux.yml
index dbfe506ee1a..62fce31d88e 100644
--- a/.github/workflows/ci-build-linux.yml
+++ b/.github/workflows/ci-build-linux.yml
@@ -227,7 +227,7 @@ jobs:
       RELEASE_VERSION: ${{ needs.build.outputs.RELEASE_VERSION }}
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ env.GITHUB_BRANCH }}
           persist-credentials: false
diff --git a/.github/workflows/publish-insider-linux.yml b/.github/workflows/publish-insider-linux.yml
index 0589dc3443c..6a78d4714dd 100644
--- a/.github/workflows/publish-insider-linux.yml
+++ b/.github/workflows/publish-insider-linux.yml
@@ -263,7 +263,7 @@ jobs:
     if: needs.check.outputs.SHOULD_BUILD_APPIMAGE != 'no' && needs.build.outputs.SHOULD_BUILD == 'yes'
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ env.GITHUB_BRANCH }}
           persist-credentials: false
@@ -543,7 +543,7 @@ jobs:
       #     snap: ${{ steps.build.outputs.snap }}
       #     isClassic: 'true'
 
-      - uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de # latest
+      - uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de # 2.11.5
         with:
           repo_name: ${{ env.ASSETS_REPOSITORY }}
           repo_token: ${{ secrets.STRONGER_GITHUB_TOKEN }}
diff --git a/.github/workflows/publish-insider-windows.yml b/.github/workflows/publish-insider-windows.yml
index 20796f8b041..b931fc76ee3 100644
--- a/.github/workflows/publish-insider-windows.yml
+++ b/.github/workflows/publish-insider-windows.yml
@@ -245,7 +245,7 @@ jobs:
           RELEASE_VERSION: ${{ needs.build.outputs.RELEASE_VERSION }}
 
       - name: Release to WinGet
-        uses: vedantmgoyal9/winget-releaser@4ffc7888bffd451b357355dc214d43bb9f23917e
+        uses: vedantmgoyal9/winget-releaser@4ffc7888bffd451b357355dc214d43bb9f23917e # v2
         with:
           identifier: ${{ env.APP_IDENTIFIER }}
           version: ${{ env.RELEASE_VERSION }}
diff --git a/.github/workflows/publish-stable-linux.yml b/.github/workflows/publish-stable-linux.yml
index c6e7fa2a547..e906623f053 100644
--- a/.github/workflows/publish-stable-linux.yml
+++ b/.github/workflows/publish-stable-linux.yml
@@ -264,7 +264,7 @@ jobs:
     if: needs.check.outputs.SHOULD_BUILD_APPIMAGE != 'no' && needs.build.outputs.SHOULD_BUILD == 'yes'
 
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ env.GITHUB_BRANCH }}
           persist-credentials: false
@@ -548,7 +548,7 @@ jobs:
           isClassic: 'true'
         if: env.SHOULD_DEPLOY_TO_RELEASE == 'yes' || env.SHOULD_DEPLOY_TO_STORE == 'yes'
 
-      - uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de # latest
+      - uses: svenstaro/upload-release-action@29e53e917877a24fad85510ded594ab3c9ca12de # 2.11.5
         with:
           repo_name: ${{ env.ASSETS_REPOSITORY }}
           repo_token: ${{ secrets.STRONGER_GITHUB_TOKEN }}
@@ -556,7 +556,7 @@ jobs:
           tag: ${{ env.RELEASE_VERSION }}
         if: env.SHOULD_DEPLOY_TO_RELEASE == 'yes'
 
-      - uses: snapcore/action-publish@214b86e5ca036ead1668c79afb81e550e6c54d40
+      - uses: snapcore/action-publish@214b86e5ca036ead1668c79afb81e550e6c54d40 # v1.2.0
         env:
           SNAPCRAFT_STORE_CREDENTIALS: ${{ secrets.SNAP_STORE_LOGIN }}
         with:
diff --git a/.github/workflows/publish-stable-windows.yml b/.github/workflows/publish-stable-windows.yml
index 44a5b7160d3..e051ad6e607 100644
--- a/.github/workflows/publish-stable-windows.yml
+++ b/.github/workflows/publish-stable-windows.yml
@@ -243,7 +243,7 @@ jobs:
           RELEASE_VERSION: ${{ needs.build.outputs.RELEASE_VERSION }}
 
       - name: Release to WinGet
-        uses: vedantmgoyal9/winget-releaser@4ffc7888bffd451b357355dc214d43bb9f23917e
+        uses: vedantmgoyal9/winget-releaser@4ffc7888bffd451b357355dc214d43bb9f23917e # v2
         with:
           identifier: ${{ env.APP_IDENTIFIER }}
           version: ${{ env.RELEASE_VERSION }}
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
index f86b55dc7bd..370181f0b1b 100644
--- a/.github/zizmor.yml
+++ b/.github/zizmor.yml
@@ -3,4 +3,6 @@ rules:
     ignore:
       # allows `svenstaro/upload-release-action` action
       - publish-insider-linux.yml:482
+      - publish-insider-linux.yml:546
       - publish-stable-linux.yml:487
+      - publish-stable-linux.yml:551