diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a202ede5..427fc857 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -144,7 +144,7 @@ jobs:
 
             - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
 
-            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+            - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
               with:
                   node-version: 22
                   cache: pnpm
@@ -201,7 +201,7 @@ jobs:
             - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
               if: needs.changes.outputs.docs_only != 'true'
 
-            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+            - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
               if: needs.changes.outputs.docs_only != 'true'
               with:
                   node-version: 22
@@ -243,7 +243,7 @@ jobs:
             - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
               if: needs.changes.outputs.docs_only != 'true'
 
-            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+            - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
               if: needs.changes.outputs.docs_only != 'true'
               with:
                   node-version: 22
@@ -264,7 +264,7 @@ jobs:
 
             - name: Upload coverage artifact
               if: needs.changes.outputs.docs_only != 'true'
-              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+              uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
               with:
                   name: frontend-coverage-report
                   path: apps/desktop/.coverage/unit
@@ -280,7 +280,7 @@ jobs:
 
             - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
 
-            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+            - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
               with:
                   node-version: 22
                   cache: pnpm
@@ -307,7 +307,7 @@ jobs:
             - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
               if: needs.changes.outputs.docs_only != 'true'
 
-            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+            - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
               if: needs.changes.outputs.docs_only != 'true'
               with:
                   node-version: 22
@@ -366,7 +366,7 @@ jobs:
 
             - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
 
-            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+            - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
               with:
                   node-version: 22
                   cache: pnpm
diff --git a/.github/workflows/e2e-smoke.yml b/.github/workflows/e2e-smoke.yml
index a5c0bf06..5a87a839 100644
--- a/.github/workflows/e2e-smoke.yml
+++ b/.github/workflows/e2e-smoke.yml
@@ -139,7 +139,7 @@ jobs:
 
             - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
 
-            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+            - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
               with:
                   node-version: 22
                   package-manager-cache: false
diff --git a/.github/workflows/pages.yml b/.github/workflows/pages.yml
index 61f2f02c..2d11b6f0 100644
--- a/.github/workflows/pages.yml
+++ b/.github/workflows/pages.yml
@@ -30,7 +30,7 @@ jobs:
 
             - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
 
-            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+            - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
               with:
                   node-version: 22
                   cache: pnpm
@@ -48,7 +48,7 @@ jobs:
               run: pnpm site:build
 
             - name: Upload Pages artifact
-              uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
+              uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
               with:
                   path: apps/site/dist
 
@@ -62,4 +62,4 @@ jobs:
         steps:
             - name: Deploy to GitHub Pages
               id: deployment
-              uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
+              uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 107e6b69..dffb0401 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -42,7 +42,7 @@ jobs:
               with:
                   persist-credentials: false
 
-            - uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4
+            - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
               id: release
               with:
                   token: ${{ secrets.RELEASE_PLEASE_TOKEN }}
@@ -70,7 +70,7 @@ jobs:
             - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
               if: ${{ steps.release.outputs.prs_created == 'true' }}
 
-            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+            - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
               if: ${{ steps.release.outputs.prs_created == 'true' }}
               with:
                   node-version: 22
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a67b4039..a74baddc 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -42,7 +42,7 @@ jobs:
               with:
                   fetch-depth: 0
 
-            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+            - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
               with:
                   node-version: 22
 
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index bf00e29f..05f02c33 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -121,7 +121,7 @@ jobs:
 
             - name: Set up Node
               if: needs.changes.outputs.docs_only != 'true' && matrix.language == 'rust'
-              uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+              uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
               with:
                   node-version: 22
 
@@ -152,7 +152,7 @@ jobs:
         steps:
             - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
-            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+            - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
               with:
                   node-version: 22
                   cache: pnpm
diff --git a/.github/workflows/velopack-build.yml b/.github/workflows/velopack-build.yml
index cba2ca9a..d3ae5aa0 100644
--- a/.github/workflows/velopack-build.yml
+++ b/.github/workflows/velopack-build.yml
@@ -45,7 +45,7 @@ jobs:
                   ref: ${{ inputs.target-commitish }}
                   fetch-depth: 0
 
-            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+            - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
               with:
                   node-version: 22
 
@@ -172,7 +172,7 @@ jobs:
 
             - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
 
-            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+            - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
               with:
                   node-version: 22
                   cache: pnpm
@@ -181,7 +181,7 @@ jobs:
               uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
 
             - name: Install .NET SDK
-              uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5
+              uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
               with:
                   dotnet-version: 8.0.x
 
@@ -230,7 +230,7 @@ jobs:
               run: dotnet tool install --global vpk
 
             - name: Download release notes artifact
-              uses: actions/download-artifact@v4
+              uses: actions/download-artifact@v8
               with:
                   name: ${{ needs.prepare-release.outputs.artifact_release_notes_name }}
                   path: ${{ runner.temp }}/release-notes
@@ -321,7 +321,7 @@ jobs:
 
             - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
 
-            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+            - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
               with:
                   node-version: 22
                   cache: pnpm
@@ -415,7 +415,7 @@ jobs:
 
             - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
 
-            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+            - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
               with:
                   node-version: 22
                   cache: pnpm
@@ -533,31 +533,31 @@ jobs:
 
             - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
 
-            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+            - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
               with:
                   node-version: 22
                   cache: pnpm
 
             - name: Download release notes artifact
-              uses: actions/download-artifact@v4
+              uses: actions/download-artifact@v8
               with:
                   name: ${{ needs.prepare-release.outputs.artifact_release_notes_name }}
                   path: ${{ runner.temp }}/release-notes
 
             - name: Download Windows release assets
-              uses: actions/download-artifact@v4
+              uses: actions/download-artifact@v8
               with:
                   name: touchai-velopack-windows-${{ inputs.channel }}-${{ inputs.version }}
                   path: ${{ runner.temp }}/release-assets/windows
 
             - name: Download macOS release assets
-              uses: actions/download-artifact@v4
+              uses: actions/download-artifact@v8
               with:
                   name: touchai-macos-${{ inputs.channel }}-${{ inputs.version }}
                   path: ${{ runner.temp }}/release-assets/macos
 
             - name: Download Linux release assets
-              uses: actions/download-artifact@v4
+              uses: actions/download-artifact@v8
               with:
                   name: touchai-linux-${{ inputs.channel }}-${{ inputs.version }}
                   path: ${{ runner.temp }}/release-assets/linux
@@ -634,13 +634,13 @@ jobs:
 
             - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
 
-            - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6
+            - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v6
               with:
                   node-version: 22
                   cache: pnpm
 
             - name: Download update release feeds artifact
-              uses: actions/download-artifact@v4
+              uses: actions/download-artifact@v8
               with:
                   name: touchai-update-dist
                   path: ${{ runner.temp }}/touchai-update-dist