diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 4323fdef2..f8f38962f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,7 +14,7 @@ jobs:
   ci:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           lfs: true
@@ -89,7 +89,7 @@ jobs:
   lighthouse:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           lfs: true
@@ -111,7 +111,7 @@ jobs:
       contents: write
       id-token: write
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: 0
           lfs: true
@@ -196,7 +196,7 @@ jobs:
       url: ${{steps.deployment.outputs.page_url}}
     concurrency: pages
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           sparse-checkout: |
             .nvmrc
@@ -204,7 +204,7 @@ jobs:
             projects/internals/ci/indexnow.js
             projects/internals/ci/package.json
           sparse-checkout-cone-mode: false
-      - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d
+      - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14
         with:
           version: 2026.6.14
           install: true
@@ -241,7 +241,7 @@ jobs:
       actions: read
       contents: read
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           sparse-checkout: |
             .nvmrc
@@ -249,7 +249,7 @@ jobs:
             projects/internals/ci/indexnow.js
             projects/internals/ci/package.json
           sparse-checkout-cone-mode: false
-      - uses: jdx/mise-action@e6a8b3978addb5a52f2b4cd9d91eafa7f0ab959d
+      - uses: jdx/mise-action@9e7f7633ff6f6d6048a9418a68d48f288f50eb14
         with:
           version: 2026.6.14
           install: true
diff --git a/.github/workflows/label.yml b/.github/workflows/label.yml
index c98369974..ed3e3e3c8 100644
--- a/.github/workflows/label.yml
+++ b/.github/workflows/label.yml
@@ -15,6 +15,6 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/labeler@f27b608878404679385c85cfa523b85ccb86e213
+      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13
         with:
           sync-labels: false
diff --git a/.github/workflows/slack.yml b/.github/workflows/slack.yml
index 047630375..9085333cd 100644
--- a/.github/workflows/slack.yml
+++ b/.github/workflows/slack.yml
@@ -30,14 +30,14 @@ jobs:
     steps:
       - name: Notify primary Slack channel
         if: matrix.destination == 'primary'
-        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d
         with:
           webhook: ${{ secrets.SLACK_WEBHOOK_URL }}
           webhook-type: incoming-webhook
           payload: ${{ env.SLACK_PAYLOAD }}
       - name: Notify CI Slack channel
         if: matrix.destination == 'ci'
-        uses: slackapi/slack-github-action@45a88b9581bfab2566dc881e2cd66d334e621e2c
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d
         with:
           webhook: ${{ secrets.SLACK_WEBHOOK_URL_CI }}
           webhook-type: incoming-webhook
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 46f191e74..37bf2933a 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -16,7 +16,7 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f
+      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93
         with:
           stale-issue-label: stale
           stale-pr-label: stale