diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0d70d0a..2f6a5f4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -26,7 +26,7 @@ jobs:
       code: ${{ steps.filter.outputs.code }}
     steps:
       - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
+      - uses: dorny/paths-filter@7b450fff21473bca461d4b92ce414b9d0420d706 # v4.0.2
         id: filter
         with:
           filters: |
diff --git a/.github/workflows/conformance-fuzz.yml b/.github/workflows/conformance-fuzz.yml
index 10238db..7b41d2d 100644
--- a/.github/workflows/conformance-fuzz.yml
+++ b/.github/workflows/conformance-fuzz.yml
@@ -32,19 +32,19 @@ jobs:
 
     steps:
       # SHA-pinned to actions/checkout v4 (tag 4.2.2)
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
 
       # SHA-pinned to pnpm/action-setup v6.0.9
       - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271
 
       # SHA-pinned to actions/setup-node v4.4.0
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
         with:
           node-version: 22
           cache: pnpm
 
       # SHA-pinned to actions/setup-python v5.6.0
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1
         with:
           python-version: '3.12'
           cache: pip
diff --git a/.github/workflows/fallow.yml b/.github/workflows/fallow.yml
index d55fd8b..4ca8ba6 100644
--- a/.github/workflows/fallow.yml
+++ b/.github/workflows/fallow.yml
@@ -22,7 +22,7 @@ jobs:
           node-version: 22
           cache: pnpm
       - run: pnpm install --frozen-lockfile
-      - uses: fallow-rs/fallow@5da5e73aba1b06bebe51be17f1d65c30c5a36ee7 # v2
+      - uses: fallow-rs/fallow@0d568277b6cf91e95c98cb92f8228154e58d6984 # v2
         env:
           # fallow-rs/fallow@v2 uses actions/github-script internally which pins Node.js 20.
           # GitHub is forcing all action runners to Node.js 24 on 2026-06-02.