diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 9cd6628..71f62d5 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -23,7 +23,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup project
         uses: generoi/github-actions/setup@v1
@@ -38,7 +38,7 @@ jobs:
         uses: generoi/github-actions/setup-ddev@v1
 
       - name: Download database artifact
-        uses: dawidd6/action-download-artifact@2536c51d3d126276eb39f74d6bc9c72ac6ef30d3 # v16
+        uses: dawidd6/action-download-artifact@09b07ec687d10771279a426c79925ee415c12906 # v17
         with:
           workflow: sync-db.yml
           name: sanitized-db
@@ -70,7 +70,7 @@ jobs:
           TURNS=$(echo "$BODY" | grep -oP 'max-turns:\s*\K\d+' || echo "30")
           echo "max_turns=$TURNS" >> "$GITHUB_OUTPUT"
 
-      - uses: anthropics/claude-code-action@1fc90f3ed982521116d8ff6d85b948c9b12cae3e # v1
+      - uses: anthropics/claude-code-action@26ec041249acb0a944c0a47b6c0c13f05dbc5b44 # v1
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
           claude_args: >-
@@ -82,7 +82,7 @@ jobs:
 
       - name: Upload artifacts
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: claude-artifacts
           path: artifacts/
diff --git a/.github/workflows/codex.yml b/.github/workflows/codex.yml
index 53efc8e..343aa32 100644
--- a/.github/workflows/codex.yml
+++ b/.github/workflows/codex.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup project
         uses: generoi/github-actions/setup@v1
@@ -36,7 +36,7 @@ jobs:
         uses: generoi/github-actions/setup-ddev@v1
 
       - name: Download database artifact
-        uses: dawidd6/action-download-artifact@2536c51d3d126276eb39f74d6bc9c72ac6ef30d3 # v16
+        uses: dawidd6/action-download-artifact@09b07ec687d10771279a426c79925ee415c12906 # v17
         with:
           workflow: sync-db.yml
           name: sanitized-db
@@ -64,7 +64,7 @@ jobs:
         run: mkdir -p artifacts
 
       - name: Run Codex
-        uses: openai/codex-action@f5c0ca71642badb34c1e66321d8d85685a0fa3dc # v1
+        uses: openai/codex-action@086169432f1d2ab2f4057540b1754d550f6a1189 # v1
         with:
           openai-api-key: ${{ secrets.OPENAI_API_KEY }}
           sandbox: danger-full-access
@@ -86,7 +86,7 @@ jobs:
 
       - name: Upload artifacts
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: codex-artifacts
           path: artifacts/
diff --git a/.github/workflows/sync-db.yml b/.github/workflows/sync-db.yml
index 16e6e1f..11fa867 100644
--- a/.github/workflows/sync-db.yml
+++ b/.github/workflows/sync-db.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - uses: generoi/github-actions/ssh-agent@v1
         with:
@@ -61,7 +61,7 @@ jobs:
             -pass env:DB_ARTIFACT_KEY
 
       - name: Upload sanitized DB artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: sanitized-db
           path: .github/fixtures/sanitized-db.sql.gz.enc