diff --git a/.github/workflows/triage.yml b/.github/workflows/triage.yml
index 8f5972c..33512ba 100644
--- a/.github/workflows/triage.yml
+++ b/.github/workflows/triage.yml
@@ -263,7 +263,7 @@ jobs:
 
       - name: Upload triage context
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: triage-context
           path: |
@@ -315,7 +315,7 @@ jobs:
           fetch-depth: 0
 
       - name: Download triage context
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: triage-context
           path: /tmp/triage-context
@@ -664,7 +664,7 @@ jobs:
 
       - name: Upload autofix outcome
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: autofix-result-${{ steps.meta.outputs.artifact_slug || 'unknown' }}-${{ strategy.job-index }}
           path: /tmp/autofix-result.json
diff --git a/setup/action.yml b/setup/action.yml
index 572e44d..521f6d6 100644
--- a/setup/action.yml
+++ b/setup/action.yml
@@ -41,7 +41,7 @@ runs:
           *"$nl"*)             echo "working-directory must not contain a newline" >&2; exit 1 ;;
         esac
 
-    - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+    - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: ${{ inputs.node-version }}
 
diff --git a/upload-report/action.yml b/upload-report/action.yml
index 7387369..77c8241 100644
--- a/upload-report/action.yml
+++ b/upload-report/action.yml
@@ -25,7 +25,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: ${{ inputs.name }}
         path: |