diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 41ebcb891..29f67a743 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -148,15 +148,15 @@ jobs:
       PAYPAL_CLIENT_ID_LEGACY: ${{ secrets.PAYPAL_CLIENT_ID_LEGACY }}
       PAYPAL_SECRET_LEGACY: ${{ secrets.PAYPAL_SECRET_LEGACY }}
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Setup pnpm
-        uses: pnpm/action-setup@a7487c7e89a18df4991f7f222e4898a00d66ddda # v4.1.0
+        uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
         with:
           run_install: false
       - name: Setup Node
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ matrix.node_version }}
           cache: pnpm
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e30a759c3..0f123d233 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -30,7 +30,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/docker-image-build-publish.yml b/.github/workflows/docker-image-build-publish.yml
index 57619727f..1f13c19c2 100644
--- a/.github/workflows/docker-image-build-publish.yml
+++ b/.github/workflows/docker-image-build-publish.yml
@@ -44,17 +44,17 @@ jobs:
     steps:
       # Checkout the repository to the runner
       - name: Checkout repository
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       # Set up Docker Buildx
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       # Log into GitHub Container Registry using a GitHub token
       - name: Log into GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
diff --git a/.github/workflows/release-convert-sqlite-to-eml.yml b/.github/workflows/release-convert-sqlite-to-eml.yml
index 935f8f0f4..cc08030c4 100644
--- a/.github/workflows/release-convert-sqlite-to-eml.yml
+++ b/.github/workflows/release-convert-sqlite-to-eml.yml
@@ -36,11 +36,11 @@ jobs:
         working-directory: tools/convert-sqlite-to-eml
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: 22
 
@@ -79,7 +79,7 @@ jobs:
 
       - name: Upload binary to release (Linux/macOS)
         if: runner.os != 'Windows'
-        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           files: tools/convert-sqlite-to-eml/dist/${{ matrix.artifact }}
         env:
@@ -87,7 +87,7 @@ jobs:
 
       - name: Upload binary to release (Windows)
         if: runner.os == 'Windows'
-        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           files: tools/convert-sqlite-to-eml/dist/${{ matrix.artifact }}.exe
         env: