diff --git a/.github/workflows/deploy-site.yml b/.github/workflows/deploy-site.yml
index d9f7a2b..7256002 100644
--- a/.github/workflows/deploy-site.yml
+++ b/.github/workflows/deploy-site.yml
@@ -55,7 +55,7 @@ jobs:
         working-directory: site
 
       - name: Build with Astro
-        uses: withastro/action@e84f40bd8d2caa9e768ec82ad30dd81f0b280853 # v6
+        uses: withastro/action@3eafd002e65cc31b4f0eae0bb05450d521562247 # v6
         with:
           # The Astro project is not at the repo root any more.
           path: site
@@ -73,4 +73,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346 # v5
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 616e169..697064f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -674,7 +674,7 @@ jobs:
 
       - name: Publish GitHub Release (signed)
         if: steps.signing.outputs.enabled == 'true'
-        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           # tag_name is required now that no tag triggered this run — without it the action would
           # create a release named after the branch.
@@ -694,7 +694,7 @@ jobs:
 
       - name: Publish GitHub Release (unsigned)
         if: steps.signing.outputs.enabled != 'true'
-        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           tag_name: ${{ needs.plan.outputs.tag }}
           target_commitish: ${{ steps.tag.outputs.sha }}