diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 2db5dcc..d897165 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -14,7 +14,7 @@ env:
   PALETTE_REGISTRY_CLI_VERSION: 4.6.1
   K9S_VERSION: 0.32.5
   SPECTRO_CLI_VERSION: 4.6.0
-  NODE_VERSION: "22"
+  NODE_VERSION: "24"
 
 jobs:
   docker:
@@ -24,12 +24,13 @@ jobs:
       VERSION: ${{ steps.get-version.outputs.version }}
     steps:
       - name: Setup nodeJs
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ env.NODE_VERSION }}
+          package-manager-cache: false
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: "Get dependencies"
         id: dependencies
@@ -42,15 +43,15 @@ jobs:
 
       - name: Set up QEMU
         if: ${{ steps.dependencies.outputs.VERSION != ''}}
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
 
       - name: "Set up Docker Buildx"
         if: ${{ steps.dependencies.outputs.VERSION != ''}}
-        uses: docker/setup-buildx-action@v4.3.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Login to GHCR
         if: ${{ steps.dependencies.outputs.VERSION != ''}}
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
@@ -58,7 +59,7 @@ jobs:
 
       - name: Build and push
         if: ${{ steps.dependencies.outputs.VERSION != ''}}
-        uses: docker/build-push-action@v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         id: build-and-push
         with:
           context: .
@@ -75,15 +76,15 @@ jobs:
           push: true
           tags: ghcr.io/${{ github.repository }}:${{steps.dependencies.outputs.VERSION}}
 
-      - uses: sigstore/cosign-installer@v4.1.2
+      - uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
 
       - name: Image Signing
         if: ${{ steps.dependencies.outputs.VERSION != ''}}
         run: |
           cosign sign --yes \
-          -a "repo=${{ github.repository }}" \
-          -a "workflow=${{ github.workflow }}" \
-          -a "ref=${{ github.sha }}" \
+          -a "repo=${GITHUB_REPOSITORY}" \
+          -a "workflow=${GITHUB_WORKFLOW}" \
+          -a "ref=${GITHUB_SHA}" \
           -a "owner=Spectro Cloud" \
           --key env://COSIGN_PRIVATE_KEY --recursive "${TAGS}@${DIGEST}"
         env:
@@ -99,10 +100,10 @@ jobs:
     steps:
       - id: checkout
         name: Checkout Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Nodejs
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index 43355bc..1c37b4f 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -6,7 +6,6 @@ on:
 
 permissions:
   contents: read
-  packages: write   # <-- needed to push to GHCR
 
 env:
   GITHUB_TOKEN: ${{ github.token }}
@@ -18,7 +17,7 @@ env:
   PALETTE_REGISTRY_CLI_VERSION: 4.5.0
   K9S_VERSION: 0.32.5
   SPECTRO_CLI_VERSION: 4.6.0  
-  NODE_VERSION: "22"
+  NODE_VERSION: "24"
 
 concurrency:
   group: docker-${{ github.ref }}
@@ -41,35 +40,39 @@ jobs:
     name: "Docker Dev image"
     needs: [run-ci]
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write # needed to push to GHCR
     if: ${{ !github.event.pull_request.draft }}
     steps:
       - id: checkout
         name: Checkout Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Nodejs
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ env.NODE_VERSION }}
+          package-manager-cache: false
 
       - name: Install dependencies
         run: npm ci
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4.3.0
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Login to GHCR
-        uses: docker/login-action@v4.6.0
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and Push Docker Image
-        uses: docker/build-push-action@v7.3.0
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           platforms: linux/amd64,linux/arm64
@@ -92,12 +95,12 @@ jobs:
     if: ${{ !github.event.pull_request.draft }}
     steps:
       - name: Setup nodeJs
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install dependencies
         run: npm ci