diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 538fa2df8..3bf44ab6f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,7 +17,7 @@ jobs:
   ci:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           lfs: true
@@ -92,7 +92,7 @@ jobs:
   lighthouse:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           lfs: true
@@ -114,7 +114,7 @@ jobs:
       contents: write
       id-token: write
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           lfs: true
@@ -199,7 +199,7 @@ jobs:
       url: ${{steps.deployment.outputs.page_url}}
     concurrency: pages
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           sparse-checkout: |
             .nvmrc
@@ -207,7 +207,7 @@ jobs:
             projects/internals/ci/indexnow.js
             projects/internals/ci/package.json
           sparse-checkout-cone-mode: false
-      - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518
         with:
           version: 2026.6.14
           install: true
@@ -244,7 +244,7 @@ jobs:
       actions: read
       contents: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           sparse-checkout: |
             .nvmrc
@@ -252,7 +252,7 @@ jobs:
             projects/internals/ci/indexnow.js
             projects/internals/ci/package.json
           sparse-checkout-cone-mode: false
-      - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d
+      - uses: jdx/mise-action@3c2e0cf82a5b2e5249f0d3635a4d83d0ae861518
         with:
           version: 2026.6.14
           install: true
diff --git a/.github/workflows/label.yml b/.github/workflows/label.yml
index c98369974..ed3e3e3c8 100644
--- a/.github/workflows/label.yml
+++ b/.github/workflows/label.yml
@@ -15,6 +15,6 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213
+      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13
         with:
           sync-labels: false
diff --git a/.github/workflows/slack.yml b/.github/workflows/slack.yml
index 047630375..9085333cd 100644
--- a/.github/workflows/slack.yml
+++ b/.github/workflows/slack.yml
@@ -30,14 +30,14 @@ jobs:
     steps:
       - name: Notify primary Slack channel
         if: matrix.destination == 'primary'
-        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d
         with:
           webhook: ${{ secrets.SLACK_WEBHOOK_URL }}
           webhook-type: incoming-webhook
           payload: ${{ env.SLACK_PAYLOAD }}
       - name: Notify CI Slack channel
         if: matrix.destination == 'ci'
-        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d
         with:
           webhook: ${{ secrets.SLACK_WEBHOOK_URL_CI }}
           webhook-type: incoming-webhook
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 46f191e74..37bf2933a 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -16,7 +16,7 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f
+      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93
         with:
           stale-issue-label: stale
           stale-pr-label: stale