diff --git a/.github/workflows/build-deploy.yml b/.github/workflows/build-deploy.yml
index 5631605..66d9f8f 100644
--- a/.github/workflows/build-deploy.yml
+++ b/.github/workflows/build-deploy.yml
@@ -36,7 +36,7 @@ jobs:
       # Fresh runner DB — no need to restart the db container during testsetup.
       SKIP_DB_RESTART: "True"
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           submodules: recursive
 
@@ -49,7 +49,7 @@ jobs:
       # `pipenv sync` is repeated cold on every triage run. Saved at job end.
       - name: Restore Python venv
         id: venv-cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .adxvenv
           key: adxvenv-${{ runner.os }}-${{ hashFiles('Pipfile.lock') }}
@@ -60,7 +60,7 @@ jobs:
       # React app on every boot. Cache its node_modules on the React yarn.lock.
       - name: Restore unaids React node_modules
         id: react-cache
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: submodules/ckanext-unaids/ckanext/unaids/react/node_modules
           key: react-nm-${{ runner.os }}-${{ hashFiles('submodules/ckanext-unaids/ckanext/unaids/react/yarn.lock') }}
@@ -192,14 +192,14 @@ jobs:
 
       - name: Save Python venv
         if: always() && steps.venv-cache.outputs.cache-hit != 'true'
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .adxvenv
           key: ${{ steps.venv-cache.outputs.cache-primary-key }}
 
       - name: Save unaids React node_modules
         if: always() && steps.react-cache.outputs.cache-hit != 'true'
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: submodules/ckanext-unaids/ckanext/unaids/react/node_modules
           key: ${{ steps.react-cache.outputs.cache-primary-key }}
@@ -218,16 +218,16 @@ jobs:
       tags: ${{ steps.meta.outputs.tags }}
       labels: ${{ steps.meta.outputs.labels }}
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           submodules: recursive
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.6.1
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: ${{ env.ACR_NAME }}.azurecr.io/${{ env.IMAGE_NAME }}
           tags: |
@@ -265,7 +265,7 @@ jobs:
         uses: docker/setup-buildx-action@v3
 
       - name: Login to ACR
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ${{ env.ACR_NAME }}.azurecr.io
           username: ${{ secrets.ACR_USERNAME }}
@@ -275,7 +275,7 @@ jobs:
       # cache hit (nothing to rebuild), it just uploads and pushes the
       # already-built layers now that tests have passed.
       - name: Push
-        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.10.0
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           file: deploy/Dockerfile.prod
@@ -299,7 +299,7 @@ jobs:
       name: staging
       url: ${{ env.URL }}
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Resolve image tag
         id: params
diff --git a/.github/workflows/release-deploy.yml b/.github/workflows/release-deploy.yml
index 8f97a2d..ebf28f9 100644
--- a/.github/workflows/release-deploy.yml
+++ b/.github/workflows/release-deploy.yml
@@ -34,7 +34,7 @@ jobs:
       name: production
       url: ${{ env.URL }}
     steps:
-      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 
@@ -54,7 +54,7 @@ jobs:
           echo "source_tag=sha-$SHORT_SHA" >> $GITHUB_OUTPUT
 
       - name: Login to ACR
-        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ${{ env.ACR_NAME }}.azurecr.io
           username: ${{ secrets.ACR_USERNAME }}