diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index 102a8b53e78..5c5129c51a2 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions-rs/audit-check@v1
+      - uses: actions/checkout@v4
+      - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 #v2.0.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b1a91b2098c..0fa6d58bbb7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -42,7 +42,7 @@ jobs:
         # https://github.com/smorimoto/tune-github-hosted-runner-network/blob/main/action.yml
         run: sudo ethtool -K eth0 tx off rx off
       - name: Checkout sources
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       # Don't use the rust-cache as it leads to 'no space left on device' errors
       # - uses: Swatinem/rust-cache@v2
       - name: Install lld
@@ -86,10 +86,10 @@ jobs:
         # https://github.com/smorimoto/tune-github-hosted-runner-network/blob/main/action.yml
         run: sudo ethtool -K eth0 tx off rx off
       - name: Checkout sources
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
 
       - name: Install Node 20
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: "20"
           cache: yarn
@@ -137,11 +137,11 @@ jobs:
         # https://github.com/smorimoto/tune-github-hosted-runner-network/blob/main/action.yml
         run: sudo ethtool -K eth0 tx off rx off
       - name: Checkout sources
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4
       - uses: Swatinem/rust-cache@v2
 
       - name: Install Node 20
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: "20"
           cache: yarn
@@ -183,7 +183,7 @@ jobs:
     env:
       RUSTFLAGS: "-D warnings"
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
 
       - name: Check formatting
         uses: actions-rs/cargo@v1
@@ -196,7 +196,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
       # Unlike rustfmt, Clippy actually compiles stuff so it benefits from
       # caching.
       - uses: Swatinem/rust-cache@v2
@@ -214,7 +214,7 @@ jobs:
     env:
       RUSTFLAGS: "-D warnings"
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
       - uses: Swatinem/rust-cache@v2
       - name: Install dependencies
         run: |
diff --git a/.github/workflows/code-coverage.yml b/.github/workflows/code-coverage.yml
index 5ca14794035..0468f22ff08 100644
--- a/.github/workflows/code-coverage.yml
+++ b/.github/workflows/code-coverage.yml
@@ -39,10 +39,10 @@ jobs:
         ports:
           - 5432:5432
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
       - uses: Swatinem/rust-cache@v2
       - name: Install Node 14
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@v4
         with:
           node-version: "14"
           cache: yarn
@@ -62,12 +62,12 @@ jobs:
 
       - name: Generate code coverage
         run: cargo llvm-cov --package graph-tests --lcov --output-path lcov.info -- --nocapture
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@v4
         with:
           name: code-coverage-info
           path: lcov.info
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@v5
         with:
           # No token needed, because the repo is public.
           files: lcov.info