diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index db0eb0a..d0c7061 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -52,7 +52,7 @@ jobs:
     steps:
       - name: Free up space
         run: sudo rm -rf /opt/hostedtoolcache /usr/share/dotnet /usr/local/lib/android /opt/ghc /usr/local/.ghcup || true
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           submodules: recursive
 
@@ -62,7 +62,7 @@ jobs:
           rustup default stable
           rustup target add ${{ matrix.target }}
 
-      - uses: taiki-e/install-action@v2.79.1
+      - uses: taiki-e/install-action@v2.81.1
         with:
           tool: just
 
@@ -94,7 +94,7 @@ jobs:
       - name: Login to ghcr.io
         run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u $ --password-stdin
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
         with:
           submodules: recursive
 
@@ -143,7 +143,7 @@ jobs:
             org.opencontainers.image.licenses=GPL-3.0-or-later
 
       - name: Build and push
-        uses: docker/build-push-action@v7.1.0
+        uses: docker/build-push-action@v7.2.0
         with:
           context: .github/build-context
           file: Containerfile
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c41b64a..e4a1155 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -28,7 +28,7 @@ jobs:
     runs-on: ${{ matrix.platform }}
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
       - name: Configure toolchain
         run: |
           rustup toolchain install --profile minimal --no-self-update stable
@@ -41,7 +41,7 @@ jobs:
     name: Clippy
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
       - name: Configure toolchain
         run: |
           rustup toolchain install --profile minimal --no-self-update stable
@@ -54,7 +54,7 @@ jobs:
     name: Generate CRDs
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
       - name: Configure toolchain
         run: |
           rustup toolchain install --profile minimal --no-self-update stable
@@ -72,7 +72,7 @@ jobs:
     needs: [gen-crds]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
       - uses: actions/download-artifact@v8
         with:
           name: crds
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index 4a9ebdf..90fd480 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -57,7 +57,7 @@ jobs:
             needs_non_pg_snapshot: false
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
 
       - name: Configure toolchain
         run: |
diff --git a/.github/workflows/typos.yml b/.github/workflows/typos.yml
index 080d79d..3306b14 100644
--- a/.github/workflows/typos.yml
+++ b/.github/workflows/typos.yml
@@ -10,8 +10,8 @@ jobs:
     name: Spellcheck
     runs-on: ubuntu-slim
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.0.2
       - name: Check spelling
-        uses: crate-ci/typos@v1.46.2
+        uses: crate-ci/typos@v1.47.0
         with:
           config: .typos.toml