diff --git a/.github/actions/setup-backend/action.yml b/.github/actions/setup-backend/action.yml
index daba1ea..f02fab6 100644
--- a/.github/actions/setup-backend/action.yml
+++ b/.github/actions/setup-backend/action.yml
@@ -13,7 +13,7 @@ runs:
   using: composite
   steps:
     - name: Setup Python
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@v7.0.0
       with:
         python-version-file: backend/.python-version
         cache: pip
diff --git a/.github/actions/setup-frontend/action.yml b/.github/actions/setup-frontend/action.yml
index d7af428..c280414 100644
--- a/.github/actions/setup-frontend/action.yml
+++ b/.github/actions/setup-frontend/action.yml
@@ -13,7 +13,7 @@ runs:
   using: composite
   steps:
     - name: Setup Node
-      uses: actions/setup-node@v7
+      uses: actions/setup-node@v7.0.0
       with:
         node-version-file: frontend/.nvmrc
         cache: npm
diff --git a/.github/actions/setup-landing/action.yml b/.github/actions/setup-landing/action.yml
index 158c0b8..5cd0997 100644
--- a/.github/actions/setup-landing/action.yml
+++ b/.github/actions/setup-landing/action.yml
@@ -13,7 +13,7 @@ runs:
   using: composite
   steps:
     - name: Setup Node
-      uses: actions/setup-node@v7
+      uses: actions/setup-node@v7.0.0
       with:
         node-version-file: frontend-landing/.nvmrc
         cache: npm
diff --git a/.github/workflows/build-support-images.yml b/.github/workflows/build-support-images.yml
index 5cf9c6e..3b61925 100644
--- a/.github/workflows/build-support-images.yml
+++ b/.github/workflows/build-support-images.yml
@@ -44,13 +44,13 @@ jobs:
           swap-storage: false
 
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v4.3.0
 
       - name: Log into registry ${{ env.REGISTRY }}
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.6.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -58,7 +58,7 @@ jobs:
 
       - name: Extract Docker metadata
         id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@v6.2.0
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
@@ -66,7 +66,7 @@ jobs:
             type=sha
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v7.3.0
         with:
           context: .
           file: Dockerfile.builder
diff --git a/.github/workflows/build-test.yml b/.github/workflows/build-test.yml
index cebc32a..5a32db2 100644
--- a/.github/workflows/build-test.yml
+++ b/.github/workflows/build-test.yml
@@ -22,7 +22,7 @@ jobs:
         working-directory: frontend
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           ref: ${{ inputs.ref }}
 
@@ -49,7 +49,7 @@ jobs:
         working-directory: backend
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           ref: ${{ inputs.ref }}
 
@@ -70,7 +70,7 @@ jobs:
       ASTRO_TELEMETRY_DISABLED: "1"
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           ref: ${{ inputs.ref }}
 
@@ -95,15 +95,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           ref: ${{ inputs.ref }}
 
       - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v4.3.0
 
       - name: Build Docker image (no push)
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v7.3.0
         with:
           context: .
           push: false
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fe1d187..4e56fb9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -38,7 +38,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
 
@@ -57,7 +57,7 @@ jobs:
         run: python -m pytest --junitxml=test-results/junit.xml --cov=splex --cov-report=xml:coverage.xml
 
       - name: SonarCloud Scan
-        uses: SonarSource/sonarcloud-github-action@v5
+        uses: SonarSource/sonarcloud-github-action@v5.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
@@ -71,7 +71,7 @@ jobs:
       should_release: ${{ steps.evaluate.outputs.should_release }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
 
diff --git a/.github/workflows/expo-sdk-update.yml b/.github/workflows/expo-sdk-update.yml
index 121e34c..a1ccc47 100644
--- a/.github/workflows/expo-sdk-update.yml
+++ b/.github/workflows/expo-sdk-update.yml
@@ -38,7 +38,7 @@ jobs:
         working-directory: frontend
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Setup frontend
         uses: ./.github/actions/setup-frontend
@@ -85,7 +85,7 @@ jobs:
 
       - name: Create or update pull request
         if: steps.diff.outputs.changed == 'true'
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@v8.1.1
         with:
           add-paths: |
             frontend/package.json
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3f0eef8..777ccf4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -41,17 +41,17 @@ jobs:
       tag: ${{ steps.semantic.outputs.new_release_git_tag }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v7.0.0
         with:
           node-version-file: frontend/.nvmrc
 
       - name: Setup Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@v7.0.0
         with:
           python-version-file: backend/.python-version
 
@@ -146,7 +146,7 @@ jobs:
       changed: ${{ steps.compare.outputs.changed }}
     steps:
       - name: Checkout release commit
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           ref: ${{ github.sha }}
           fetch-depth: 0
@@ -169,7 +169,7 @@ jobs:
 
       - name: Checkout previous tag
         if: steps.prev-tag.outputs.tag != ''
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           ref: ${{ steps.prev-tag.outputs.tag }}
           path: prev-release
@@ -216,17 +216,17 @@ jobs:
       pull-requests: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@v7.0.0
         with:
           node-version-file: frontend/.nvmrc
 
       - name: Setup Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@v7.0.0
         with:
           python-version-file: backend/.python-version
 
@@ -252,22 +252,22 @@ jobs:
       packages: write
     steps:
       - name: Checkout tag
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           ref: ${{ needs.semantic-preview.outputs.tag }}
 
       - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@v4.3.0
 
       - name: Log into ghcr.io
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@v7.3.0
         with:
           context: .
           push: true
@@ -289,7 +289,7 @@ jobs:
       EXPO_TOKEN: ${{ secrets.EXPO_TOKEN }}
     steps:
       - name: Checkout tag
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           ref: ${{ needs.semantic-preview.outputs.tag }}
 
@@ -323,12 +323,12 @@ jobs:
           swap-storage: false
 
       - name: Checkout tag
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           ref: ${{ needs.semantic-preview.outputs.tag }}
 
       - name: Log into ghcr.io
-        uses: docker/login-action@v4
+        uses: docker/login-action@v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -363,7 +363,7 @@ jobs:
             production-apk "splex-${RELEASE_VERSION}.apk"
 
       - name: Attach AAB and APK to GitHub release
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@v3.0.3
         with:
           tag_name: ${{ needs.semantic-preview.outputs.tag }}
           files: |
@@ -381,7 +381,7 @@ jobs:
       contents: write
     steps:
       - name: Append note to GitHub release
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@v3.0.3
         with:
           tag_name: ${{ needs.semantic-preview.outputs.tag }}
           append_body: true
diff --git a/frontend-landing/package-lock.json b/frontend-landing/package-lock.json
index 471f2e0..1bca00e 100644
--- a/frontend-landing/package-lock.json
+++ b/frontend-landing/package-lock.json
@@ -20,7 +20,7 @@
         "typescript": "6.0.3"
       },
       "engines": {
-        "node": ">=22.12.0"
+        "node": "v26.8.1"
       }
     },
     "node_modules/@astrojs/check": {
diff --git a/frontend-landing/package.json b/frontend-landing/package.json
index 409c259..b5593b1 100644
--- a/frontend-landing/package.json
+++ b/frontend-landing/package.json
@@ -5,7 +5,7 @@
   "type": "module",
   "description": "Marketing landing page for Splex, served by the backend at the site root.",
   "engines": {
-    "node": ">=22.12.0"
+    "node": "v26.8.1"
   },
   "scripts": {
     "sync-assets": "node scripts/sync-assets.mjs",