diff --git a/.github/workflows/auto-merge.yaml b/.github/workflows/auto-merge.yaml
index ec6df539..15e105a9 100644
--- a/.github/workflows/auto-merge.yaml
+++ b/.github/workflows/auto-merge.yaml
@@ -22,7 +22,7 @@ name: 'Auto merge'
 
 jobs:
   auto-merge:
-    uses: conforma/github-workflows/.github/workflows/auto-merge.yaml@main
+    uses: conforma/github-workflows/.github/workflows/auto-merge.yaml@db8c967cda18f9d4c69b1808f703fb61cdf1c650 # main
     secrets: inherit
     permissions:
       pull-requests: write
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 6f61567a..34d341a5 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -30,17 +30,17 @@ jobs:
       HUGO_VERSION: 0.111.3
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Setup NodeJS environment
-        uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f # v6.1.0
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version-file: 'antora/package.json'
           cache: 'npm'
           cache-dependency-path: 'antora/package-lock.json'
 
       - name: Setup Go environment
-        uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6.5.0
         with:
           go-version-file: website/go.mod
           cache: true
diff --git a/.github/workflows/fullsend.yaml b/.github/workflows/fullsend.yaml
index 5735a1d7..0048124c 100644
--- a/.github/workflows/fullsend.yaml
+++ b/.github/workflows/fullsend.yaml
@@ -41,7 +41,7 @@ jobs:
     if: >-
       github.event_name != 'issue_comment'
       || github.event.comment.user.type != 'Bot'
-    uses: conforma/.fullsend/.github/workflows/dispatch.yml@main
+    uses: conforma/.fullsend/.github/workflows/dispatch.yml@87c4a29e530c4231be1ff214f81765f03cc178ff # main
     with:
       event_action: ${{ github.event.action }}
 
diff --git a/.github/workflows/label-pr-size.yaml b/.github/workflows/label-pr-size.yaml
index 9df05b5c..af8a2b73 100644
--- a/.github/workflows/label-pr-size.yaml
+++ b/.github/workflows/label-pr-size.yaml
@@ -29,4 +29,4 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Label PR by size
-        uses: conforma/pr-size-label-action@v1.0.0
+        uses: conforma/pr-size-label-action@9bff907ec68d5dcee52ee8b6a62cf48cf9cf3e49 # v1.2.0
diff --git a/.github/workflows/preview.yaml b/.github/workflows/preview.yaml
index d1cb34d5..a7735d44 100644
--- a/.github/workflows/preview.yaml
+++ b/.github/workflows/preview.yaml
@@ -67,7 +67,7 @@ jobs:
           echo "PR_NUMBER=${PR_NUMBER}" >> $GITHUB_OUTPUT
           echo "PR_URL=https://github.com/${GITHUB_REPOSITORY}/pull/${PR_NUMBER}" >> $GITHUB_OUTPUT
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           path: code
       - name: Preview
diff --git a/.github/workflows/scorecards.yml b/.github/workflows/scorecards.yml
index 10dcbfb8..322ff196 100644
--- a/.github/workflows/scorecards.yml
+++ b/.github/workflows/scorecards.yml
@@ -31,13 +31,13 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
+        uses: step-security/harden-runner@e14015d583714f6e62063499dc959a02595150a1 # v2.21.1
         with:
           egress-policy: audit
           disable-telemetry: true
 
       - name: "Checkout code"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
@@ -72,6 +72,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@19b2f06db2b6f5108140aeb04014ef02b648f789 # v4.31.11
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: results.sarif