diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d947d0d..486a860 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,14 +10,14 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Validate manifests parse + declare schema_version
         run: |
           for f in pack.yaml targets/*.intent.yaml _kos/kos.yaml; do
             python3 -c "import yaml; d=yaml.safe_load(open('$f')); assert 'schema_version' in d, 'missing schema_version in $f'; print('ok:', '$f')"
           done
       - name: markdownlint
-        uses: DavidAnson/markdownlint-cli2-action@b4c9feab76d8025d1e83c653fa3990936df0e6c8 # v16.0.0
+        uses: DavidAnson/markdownlint-cli2-action@21c1be1b93ad9ed58fa840aacc3f279cde2a72ff # v24.2.0
         with:
           globs: '**/*.md'
         continue-on-error: true