diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cd66ddb..2b1f8f9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,10 +13,10 @@ jobs:
   policy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
         with: { fetch-depth: 0 }   # gitleaks scans the push commit range; needs full history
 
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v6
         with: { python-version: "3.12" }
       - run: pip install -r requirements-dev.txt
 
@@ -46,7 +46,7 @@ jobs:
         run: python formal/cross_layer.py --out outputs/cross-layer || true
       - name: Upload cross-layer-lint report
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: cross-layer-report
           path: outputs/cross-layer/
@@ -102,7 +102,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: policy
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
 
       - name: Build the Cedar PDP api image
         run: docker build -t cloudsec-api:local -f app/api/Dockerfile .
@@ -167,7 +167,7 @@ jobs:
       # To surface per-check results inline in the run UI, feed this to a JUnit test-reporter.
       - name: Upload verify.sh JUnit report
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: verify-junit
           path: outputs/verify/junit.xml
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 16dbed8..9f4d407 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -24,15 +24,15 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
-      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v5
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v6
         with: { python-version: "3.12" }
       - run: pip install -r requirements-docs.txt
       - run: python -m mkdocs build --strict
         env:
           NO_MKDOCS_2_WARNING: "true"       # Material dependency ships TWO promo banners,
           DISABLE_MKDOCS_2_WARNING: "true"  # one gated by each var; both needed. Build is green either way.
-      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
+      - uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
         with:
           path: site                        # mkdocs site_dir (default artifact path is _site)
 
@@ -46,4 +46,4 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0