diff --git a/.github/workflows/cpython-wasm.yml b/.github/workflows/cpython-wasm.yml
index 06855b1..97945c5 100644
--- a/.github/workflows/cpython-wasm.yml
+++ b/.github/workflows/cpython-wasm.yml
@@ -72,7 +72,7 @@ jobs:
           echo "deploy_channel=$channel" >> "$GITHUB_OUTPUT"
           echo "deploy_destination=$destination" >> "$GITHUB_OUTPUT"
       - name: "Checkout cpython @ ${{ steps.ref.outputs.cpython_ref }}"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: "python/cpython"
           ref: ${{ steps.ref.outputs.cpython_ref }}
@@ -104,13 +104,13 @@ jobs:
         working-directory: cpython
     steps:
       - name: "Checkout codoscope"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           path: codoscope
           persist-credentials: false
 
       - name: "Checkout cpython@${{ env.CPYTHON_REF }}"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           repository: "python/cpython"
           ref: ${{ env.CPYTHON_REF }}
@@ -123,12 +123,12 @@ jobs:
           python-version: "3"
 
       - name: "Install Node"
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: ${{ needs.get-emscripten-version.outputs.node_version }}
 
       - name: "Install Emscripten SDK ${{ needs.get-emscripten-version.outputs.emscripten_version }}"
-        uses: mymindstorm/setup-emsdk@6ab9eb1bda2574c4ddb79809fc9247783eaf9021 # v14
+        uses: mymindstorm/setup-emsdk@4528d102f7230f0e7b276855c01ea1159be0e984 # v16
         with:
           version: ${{ needs.get-emscripten-version.outputs.emscripten_version }}
           actions-cache-folder: emsdk-cache
@@ -161,7 +161,7 @@ jobs:
             https://cdn.jsdelivr.net/gh/gzuidhof/coi-serviceworker@7b1d2a092d0d2dd2b7270b6f12f13605de26f214/coi-serviceworker.min.js
 
       - name: "Upload site artifact"
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: site
           path: _site
@@ -182,12 +182,12 @@ jobs:
       DEPLOY_DESTINATION: ${{ needs.get-emscripten-version.outputs.deploy_destination }}
     steps:
       - name: "Checkout"
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: true
 
       - name: "Download site artifact"
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: site
           path: site
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 14dc7cc..b580eab 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -18,7 +18,7 @@ jobs:
     timeout-minutes: 10
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
       - uses: j178/prek-action@53276d8b0d10f8b6672aa85b4588c6921d0370cc # v2.0.1
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 6d8490c..eb2b4d3 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false