diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index e28d6988d..38af7baa3 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -13,13 +13,13 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        php: [7.4, 8.0, 8.1, 8.2, 8.3, 8.4]
+        php: ['7.4', '8.0', '8.1', '8.2', '8.3', '8.4', '8.5']
         experimental: [false]
         composer-options: ['']
         include:
-          - php: 8.2
+          - php: '8.2'
             analysis: true
-          - php: 8.5
+          - php: '8.6'
             experimental: true
             composer-options: '--ignore-platform-req=php+'
           - php: nightly
@@ -28,10 +28,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up PHP ${{ matrix.php }}
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@eb7c497e18156a6bbabfef1d3a82760b9eda3962 # v2.40.0
         with:
           php-version: ${{ matrix.php }}
           coverage: xdebug
@@ -53,7 +53,7 @@ jobs:
 
       - name: Upload coverage results to Coveralls
         if: matrix.analysis
-        uses: coverallsapp/github-action@v2
+        uses: coverallsapp/github-action@8d6379e14d29928660c4ba802d8e85393440b329 # v2.3.8
         with:
           flag-name: php-${{ matrix.php }}
           files: clover.xml
diff --git a/composer.json b/composer.json
index 5fc397098..3b3bc2496 100644
--- a/composer.json
+++ b/composer.json
@@ -43,7 +43,7 @@
         "wiki": "https://github.com/slimphp/Slim/wiki"
     },
     "require": {
-        "php": "~7.4.0 || ~8.0.0 || ~8.1.0 || ~8.2.0 || ~8.3.0 || ~8.4.0 || ~8.5.0",
+        "php": "~7.4.0 || ~8.0.0 || ~8.1.0 || ~8.2.0 || ~8.3.0 || ~8.4.0 || ~8.5.0 || ~8.6.0",
         "ext-json": "*",
         "nikic/fast-route": "^1.3",
         "psr/container": "^1.0 || ^2.0",