diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index 75b8601..a1b145d 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -30,13 +30,13 @@ jobs:
       matrix:
         language: [actions, python]
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@v6.0.3
         with:
           persist-credentials: false
-      - uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v4.36.2
+      - uses: github/codeql-action/init@v4.36.2
         with:
           languages: ${{ matrix.language }}
           build-mode: none
-      - uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e  # v4.36.2
+      - uses: github/codeql-action/analyze@v4.36.2
         with:
           category: /language:${{ matrix.language }}
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index 470eda3..f18be88 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -32,11 +32,11 @@ jobs:
           apt-get update
           apt-get install --no-install-recommends -y ca-certificates git ripgrep python3 \
             agda-bin=2.6.4.3-1+b2 elixir=1.18.3.dfsg-1
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@v6.0.3
         with:
           persist-credentials: false
       - name: Checkout merged epistemic foundations
-        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+        uses: actions/checkout@v6.0.3
         with:
           repository: hyperpolymath/epistemic-types
           ref: ad14e35e6e437b116284a43ecff5ebc09d67e37e
@@ -56,7 +56,7 @@ jobs:
           git -c safe.directory="$GITHUB_WORKSPACE" -C "$GITHUB_WORKSPACE" diff --exit-code -- proofs/agda/Firmboot/ElixirAgreement.agda
       - name: Retain exact verification diagnostics
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: agda-elixir-verification
           path: .ci-results
@@ -69,7 +69,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@v6.0.3
         with:
           persist-credentials: false
       - name: Install proof audit dependency
@@ -95,7 +95,7 @@ jobs:
           bash proofs/lean/verify.sh | tee .ci-results/lean/verify.log
       - name: Retain the complete Lean proof audit log
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7.0.1
+        uses: actions/upload-artifact@v7.0.1
         with:
           name: lean-verification
           path: .ci-results/lean
@@ -108,7 +108,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@v6.0.3
         with:
           persist-credentials: false
       - name: Install the authoritative lockfile verifier
@@ -128,7 +128,7 @@ jobs:
         run: |
           apt-get update
           apt-get install --no-install-recommends -y ca-certificates git reuse=5.0.2-1
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10  # v6.0.3
+      - uses: actions/checkout@v6.0.3
         with:
           persist-credentials: false
       - name: Validate complete licence and copyright coverage