diff --git a/.github/workflows/bug-report-template.yml b/.github/workflows/bug-report-template.yml
index a042777c896..3321381c12c 100644
--- a/.github/workflows/bug-report-template.yml
+++ b/.github/workflows/bug-report-template.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - uses: tj-actions/changed-files@v47
+      - uses: tj-actions/changed-files@v47.0.5
         id: changed-files
         with:
           files: |
@@ -32,7 +32,7 @@ jobs:
             tasks/bug_report_template.rb
             Gemfile*
             *.gemspec
-      - uses: ruby/setup-ruby@v1
+      - uses: ruby/setup-ruby@v1.302.0
         if: steps.changed-files.outputs.any_changed == 'true'
         with:
           ruby-version: ${{ env.RUBY_VERSION }}
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index adea840ddb5..fec7b7204ba 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -42,7 +42,7 @@ jobs:
         run: |
           echo "BUNDLE_GEMFILE=gemfiles/${{ matrix.rails }}/Gemfile" >> "$GITHUB_ENV"
         if: matrix.rails != 'rails_81'
-      - uses: ruby/setup-ruby@v1
+      - uses: ruby/setup-ruby@v1.302.0
         with:
           ruby-version: ${{ matrix.ruby }}
           bundler-cache: true
@@ -104,14 +104,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - uses: tj-actions/changed-files@v47
+      - uses: tj-actions/changed-files@v47.0.5
         id: changed-files
         with:
           files: |
             docs/**
             package*.json
             yarn.lock
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v6.3.0
         if: steps.changed-files.outputs.any_changed == 'true'
         with:
           node-version: 24
diff --git a/.github/workflows/docs-deployment.yml b/.github/workflows/docs-deployment.yml
index 753d2275b1b..620f9e11849 100644
--- a/.github/workflows/docs-deployment.yml
+++ b/.github/workflows/docs-deployment.yml
@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v6.3.0
         with:
           node-version: 24
           cache: yarn
diff --git a/.github/workflows/eslint.yml b/.github/workflows/eslint.yml
index 2ca53fa0981..8a848cd0087 100644
--- a/.github/workflows/eslint.yml
+++ b/.github/workflows/eslint.yml
@@ -12,11 +12,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v6.3.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: yarn
-      - uses: tj-actions/changed-files@v47
+      - uses: tj-actions/changed-files@v47.0.5
         id: changed-files
         with:
           files: |
diff --git a/.github/workflows/gherkin-lint.yml b/.github/workflows/gherkin-lint.yml
index 074bbce9a68..ecfd9a3860f 100644
--- a/.github/workflows/gherkin-lint.yml
+++ b/.github/workflows/gherkin-lint.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - uses: tj-actions/changed-files@v47
+      - uses: tj-actions/changed-files@v47.0.5
         id: changed-files
         with:
           files: |
@@ -21,7 +21,7 @@ jobs:
             package*.json
             yarn.lock
             .github/workflows/gherkin-lint.yml
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@v6.3.0
         if: steps.changed-files.outputs.any_changed == 'true'
         with:
           node-version: ${{ env.NODE_VERSION }}
diff --git a/.github/workflows/github-actions-lint.yml b/.github/workflows/github-actions-lint.yml
index 0366407f5f4..71b0e9ee42c 100644
--- a/.github/workflows/github-actions-lint.yml
+++ b/.github/workflows/github-actions-lint.yml
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - uses: tj-actions/changed-files@v47
+      - uses: tj-actions/changed-files@v47.0.5
         id: changed-files
         with:
           files: |
diff --git a/.github/workflows/markdown-lint.yml b/.github/workflows/markdown-lint.yml
index 225f8815c93..a03e53cb594 100644
--- a/.github/workflows/markdown-lint.yml
+++ b/.github/workflows/markdown-lint.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - uses: tj-actions/changed-files@v47
+      - uses: tj-actions/changed-files@v47.0.5
         id: changed-files
         with:
           files: |
diff --git a/.github/workflows/rubocop.yml b/.github/workflows/rubocop.yml
index 972785ac697..6916f504853 100644
--- a/.github/workflows/rubocop.yml
+++ b/.github/workflows/rubocop.yml
@@ -14,7 +14,7 @@ jobs:
       BUNDLE_ONLY: ${{ vars.RUBOCOP_BUNDLE_ONLY || 'rubocop' }}
     steps:
       - uses: actions/checkout@v6
-      - uses: tj-actions/changed-files@v47
+      - uses: tj-actions/changed-files@v47.0.5
         id: changed-files
         with:
           files: |
@@ -29,7 +29,7 @@ jobs:
             Rakefile
             *.gemspec
             .simplecov
-      - uses: ruby/setup-ruby@v1
+      - uses: ruby/setup-ruby@v1.302.0
         if: steps.changed-files.outputs.any_changed == 'true'
         with:
           ruby-version: ${{ env.RUBY_VERSION }}
diff --git a/.github/workflows/yaml-lint.yml b/.github/workflows/yaml-lint.yml
index 8428283177c..2bf4e59ff48 100644
--- a/.github/workflows/yaml-lint.yml
+++ b/.github/workflows/yaml-lint.yml
@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - uses: tj-actions/changed-files@v47
+      - uses: tj-actions/changed-files@v47.0.5
         id: changed-files
         with:
           files: |