diff --git a/.github/workflows/binaries.yml b/.github/workflows/binaries.yml
index ed8848edd..bb2b9dff1 100644
--- a/.github/workflows/binaries.yml
+++ b/.github/workflows/binaries.yml
@@ -35,7 +35,7 @@ jobs:
             target: aarch64-unknown-linux-gnu
     runs-on: ${{ matrix.sys.os }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: ./.github/actions/build-binary
         with:
           target: ${{ matrix.sys.target }}
@@ -59,7 +59,7 @@ jobs:
             target: x86_64-apple-darwin
     runs-on: ${{ matrix.sys.os }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: ./.github/actions/build-binary
         with:
           target: ${{ matrix.sys.target }}
@@ -82,7 +82,7 @@ jobs:
             ext: .exe
     runs-on: ${{ matrix.sys.os }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: ./.github/actions/build-binary
         with:
           target: ${{ matrix.sys.target }}
@@ -104,7 +104,7 @@ jobs:
             os: ubuntu-22.04-arm
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - name: Setup vars
         run: |
@@ -157,7 +157,7 @@ jobs:
     needs: [build, build-macos, build-windows]
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - name: Setup vars
         run: |
diff --git a/.github/workflows/bindings-ts.yml b/.github/workflows/bindings-ts.yml
index 603f64955..686fbf02d 100644
--- a/.github/workflows/bindings-ts.yml
+++ b/.github/workflows/bindings-ts.yml
@@ -28,10 +28,10 @@ jobs:
         with:
           tag: latest
           protocol_version: 28
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@v7.0.0
         with:
           node-version: "20.x"
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: stellar/actions/rust-cache@main
       - run: rustup update
       - name: install optional dependencies (Linux only)
diff --git a/.github/workflows/ledger-emulator.yml b/.github/workflows/ledger-emulator.yml
index 6a449775e..43476d30e 100644
--- a/.github/workflows/ledger-emulator.yml
+++ b/.github/workflows/ledger-emulator.yml
@@ -38,7 +38,7 @@ jobs:
         with:
           tag: latest
           protocol_version: 28
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
 
       - uses: stellar/actions/rust-cache@main
 
diff --git a/.github/workflows/rpc-tests.yml b/.github/workflows/rpc-tests.yml
index d01c84921..3d247fe50 100644
--- a/.github/workflows/rpc-tests.yml
+++ b/.github/workflows/rpc-tests.yml
@@ -35,7 +35,7 @@ jobs:
         with:
           tag: latest
           protocol_version: 28
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: stellar/actions/rust-cache@main
       - run: rustup update
       - run:
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index c99e70a64..8a4080d9d 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -40,7 +40,7 @@ jobs:
         check: [advisories, bans, licenses, sources]
     continue-on-error: ${{ matrix.check == 'advisories' }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25
         with:
           command: check ${{ matrix.check }}
@@ -48,7 +48,7 @@ jobs:
   check:
     runs-on: ubuntu-latest-8-cores
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: stellar/actions/rust-cache@main
       - run: sudo apt update && sudo apt install -y libudev-dev libdbus-1-dev
       - run: rustup update
@@ -68,7 +68,7 @@ jobs:
             target: aarch64-unknown-linux-gnu
     runs-on: ${{ matrix.sys.os }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: ./.github/actions/build-and-test
         with:
           target: ${{ matrix.sys.target }}
@@ -87,7 +87,7 @@ jobs:
             target: aarch64-apple-darwin
     runs-on: ${{ matrix.sys.os }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: ./.github/actions/build-and-test
         with:
           target: ${{ matrix.sys.target }}
@@ -104,7 +104,7 @@ jobs:
             target: x86_64-pc-windows-msvc
     runs-on: ${{ matrix.sys.os }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: ./.github/actions/build-and-test
         with:
           target: ${{ matrix.sys.target }}
diff --git a/.github/workflows/socket-scan.yml b/.github/workflows/socket-scan.yml
index 497671576..29316e14e 100644
--- a/.github/workflows/socket-scan.yml
+++ b/.github/workflows/socket-scan.yml
@@ -37,9 +37,9 @@ jobs:
   socket-scan:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - run: rustup update
-      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "24.18.0"
 
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 5dfe10139..2d5b74eea 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -10,7 +10,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v10
+      - uses: actions/stale@v11
         with:
           debug-only: false
           days-before-stale: 90
diff --git a/.github/workflows/test-install.yml b/.github/workflows/test-install.yml
index 311baff83..ce9d3f7ed 100644
--- a/.github/workflows/test-install.yml
+++ b/.github/workflows/test-install.yml
@@ -25,7 +25,7 @@ jobs:
   test-install:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: ruby
diff --git a/.github/workflows/test-with-openzeppelin-contracts.yml b/.github/workflows/test-with-openzeppelin-contracts.yml
index c13bd2924..e747bb96f 100644
--- a/.github/workflows/test-with-openzeppelin-contracts.yml
+++ b/.github/workflows/test-with-openzeppelin-contracts.yml
@@ -19,7 +19,7 @@ jobs:
   build-cli:
     runs-on: ubuntu-latest-8-cores
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: stellar/actions/rust-cache@main
       - run: rustup update
       - run: sudo apt update && sudo apt install -y libudev-dev libdbus-1-dev
@@ -34,7 +34,7 @@ jobs:
     outputs:
       dirs: ${{ steps.dirs.outputs.dirs }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           repository: OpenZeppelin/stellar-contracts
       - id: dirs
@@ -55,7 +55,7 @@ jobs:
         experimental_spec_shaking_v2: [true, false]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           repository: OpenZeppelin/stellar-contracts
       - uses: actions/download-artifact@v8.0.1
diff --git a/.github/workflows/test-with-soroban-examples.yml b/.github/workflows/test-with-soroban-examples.yml
index a63d2abec..713573e16 100644
--- a/.github/workflows/test-with-soroban-examples.yml
+++ b/.github/workflows/test-with-soroban-examples.yml
@@ -19,7 +19,7 @@ jobs:
   build-cli:
     runs-on: ubuntu-latest-8-cores
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
       - uses: stellar/actions/rust-cache@main
       - run: rustup update
       - run: sudo apt update && sudo apt install -y libudev-dev libdbus-1-dev
@@ -34,7 +34,7 @@ jobs:
     outputs:
       dirs: ${{ steps.dirs.outputs.dirs }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           repository: stellar/soroban-examples
           ref: main
@@ -62,7 +62,7 @@ jobs:
         experimental_spec_shaking_v2: [true, false]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           repository: stellar/soroban-examples
           ref: main