diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index b164604..0194719 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -11,14 +11,14 @@ jobs:
     name: golangci-lint
     runs-on: blacksmith-4vcpu-ubuntu-2404
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v4
         with:
           persist-credentials: false
-      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8
+        uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
         with:
           version: latest
           args: --timeout=10m
diff --git a/.github/workflows/idle_timer.yml b/.github/workflows/idle_timer.yml
index 9448301..437b4b8 100644
--- a/.github/workflows/idle_timer.yml
+++ b/.github/workflows/idle_timer.yml
@@ -12,10 +12,10 @@ jobs:
     runs-on: blacksmith-4vcpu-ubuntu-2404
     timeout-minutes: 5
     steps:
-      - uses: actions/setup-go@be3c94b385c4f180051c996d336f57a34c397495 # v3
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: '1.21.5'
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v3
         with:
           persist-credentials: false
       - name: build bazel-remote
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ea8d1b9..f67c6a7 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -25,7 +25,7 @@ jobs:
       version: ${{ steps.release_source.outputs.version }}
     steps:
       - name: checkout release tag
-        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v3
         with:
           ref: refs/tags/${{ inputs.release_tag }}
           fetch-depth: 0
@@ -91,7 +91,7 @@ jobs:
       VERSION: ${{ needs.validate.outputs.version }}
     steps:
       - name: checkout code
-        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v3
         with:
           ref: ${{ needs.validate.outputs.source_sha }}
           persist-credentials: false
@@ -135,7 +135,7 @@ jobs:
       VERSION: ${{ needs.validate.outputs.version }}
     steps:
       - name: checkout
-        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v3
         with:
           ref: ${{ needs.validate.outputs.source_sha }}
           persist-credentials: false