diff --git a/.github/workflows/check_changelog.yml b/.github/workflows/check_changelog.yml
index c072f45f..cb1ac86e 100644
--- a/.github/workflows/check_changelog.yml
+++ b/.github/workflows/check_changelog.yml
@@ -21,7 +21,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           persist-credentials: false
-      - uses: scientific-python/action-towncrier-changelog@165df35cfb3ff4b5bfea7645c4b923c6e8c7b54a  # v2.0.0
+      - uses: scientific-python/action-towncrier-changelog@f9c7df9a9f8b55cb0c12d94d14b281e9bcd101c0  # v2.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           BOT_USERNAME: changelog-bot
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 78eea5c4..4185b7bd 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -186,7 +186,7 @@ jobs:
           name: docs-html-stable-mne
           path: docs/_build/html/
       - name: Deploy to GitHub Pages
-        uses: peaceiris/actions-gh-pages@1ef5a1b1df4c63fe21a2242edbee6cac921ece01  # v4.1.0
+        uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453  # v4.1.0
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: docs/_build/html/
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index c0abd59e..324bd071 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -227,7 +227,7 @@ jobs:
         run: pytest --cov=mne_denoise --cov-report=xml -q
       - name: Upload coverage to Codecov
         if: matrix.coverage == 'true'
-        uses: codecov/codecov-action@a99c28d3f0da835de33ff2feb2e15691c7b9641f  # v7.0.0
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f  # v7.0.0
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: ./coverage.xml