diff --git a/.github/workflows/build-and-test.yml b/.github/workflows/build-and-test.yml
index 3d8f5f8..e85a5f3 100644
--- a/.github/workflows/build-and-test.yml
+++ b/.github/workflows/build-and-test.yml
@@ -36,10 +36,10 @@ jobs:
     runs-on: ubuntu-latest
     needs: check-dist
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.ref }}
-      - uses: actions/setup-node@v3
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: package.json
           cache: yarn
@@ -53,17 +53,17 @@ jobs:
     runs-on: ubuntu-latest
     needs: check-dist
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.ref }}
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: package.json
           cache: yarn
 
       - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c # v6.2.3
         with:
           role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
           aws-region: ${{ env.AWS_REGION }}
@@ -126,11 +126,11 @@ jobs:
     runs-on: ubuntu-latest
     needs: check-dist
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.ref }}
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: package.json
           cache: yarn
diff --git a/.github/workflows/validate-codeowners.yml b/.github/workflows/validate-codeowners.yml
index e7a8159..b9272b7 100644
--- a/.github/workflows/validate-codeowners.yml
+++ b/.github/workflows/validate-codeowners.yml
@@ -4,27 +4,12 @@ on:
 
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
-  validate-codeowners:
-    runs-on: ubuntu-latest
-    steps:
-      - name: "Checkout source code at current commit"
-        uses: actions/checkout@v2
-        # Leave pinned at 0.7.1 until https://github.com/mszostok/codeowners-validator/issues/173 is resolved
-      - uses: mszostok/codeowners-validator@v0.7.1
-        if: github.event.pull_request.head.repo.full_name == github.repository
-        name: "Full check of CODEOWNERS"
-        with:
-          # For now, remove "files" check to allow CODEOWNERS to specify non-existent
-          # files so we can use the same CODEOWNERS file for Terraform and non-Terraform repos
-          #   checks: "files,syntax,owners,duppatterns"
-          checks: "syntax,owners,duppatterns"
-          owner_checker_allow_unowned_patterns: "false"
-          # GitHub access token is required only if the `owners` check is enabled
-          github_access_token: "${{ secrets.PUBLIC_REPO_ACCESS_TOKEN }}"
-      - uses: mszostok/codeowners-validator@v0.7.1
-        if: github.event.pull_request.head.repo.full_name != github.repository
-        name: "Syntax check of CODEOWNERS"
-        with:
-          checks: "syntax,duppatterns"
-          owner_checker_allow_unowned_patterns: "false"
+  ci-codeowners:
+    uses: cloudposse/.github/.github/workflows/shared-codeowners.yml@main
+    with:
+      is_fork: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }}
+    secrets: inherit
diff --git a/action.yml b/action.yml
index 00acac4..1e34a98 100644
--- a/action.yml
+++ b/action.yml
@@ -73,5 +73,5 @@ inputs:
 
 outputs: {}
 runs:
-  using: "node20"
+  using: "node24"
   main: "dist/index.js"