diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b7c8087..4147efe 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -20,11 +20,11 @@ jobs:
   build-and-test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v4.4.0
+      - uses: pnpm/action-setup@v4.4.0
+      - uses: actions/setup-node@v4.4.0
         with:
-          node-version: 22
+          node-version: 22.23.1
           registry-url: "https://registry.npmjs.org/"
       - run: pnpm install
       - run: pnpm lint
@@ -36,12 +36,12 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'release'
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v4.4.0
+      - uses: actions/setup-node@v4.4.0
         with:
-          node-version: 22
+          node-version: 22.23.1
           registry-url: "https://registry.npmjs.org/"
-      - uses: pnpm/action-setup@v4
+      - uses: pnpm/action-setup@v4.4.0
       - name: Re-install npm
         # TODO: OIDC requires npm >=11.5.1.
         # Until Node.js v24 is LTS (with npm 11 as the default), we need to bump.
@@ -71,13 +71,13 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'release'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.4.0
         with:
           ref: main
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: pnpm/action-setup@v4.4.0
+      - uses: actions/setup-node@v4.4.0
         with:
-          node-version: 22
+          node-version: 22.23.1
           cache: "pnpm"
       - name: Install dependencies (main branch)
         run: pnpm install
@@ -88,7 +88,7 @@ jobs:
           mkdir -p combined/v2
           mv docs/.vitepress/dist/* combined/v2/
       - name: Checkout release tag
-        uses: actions/checkout@v4
+        uses: actions/checkout@v4.4.0
         with:
           ref: ${{ github.ref }}
           clean: false
@@ -119,13 +119,13 @@ jobs:
     runs-on: ubuntu-latest
     if: (github.event_name == 'release' || github.event_name == 'workflow_dispatch') && github.ref != 'refs/heads/main'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.4.0
         with:
           ref: ${{ github.ref }}
-      - uses: pnpm/action-setup@v4
-      - uses: actions/setup-node@v4
+      - uses: pnpm/action-setup@v4.4.0
+      - uses: actions/setup-node@v4.4.0
         with:
-          node-version: 22
+          node-version: 22.23.1
           cache: "pnpm"
       - name: Install and build parent package
         run: |