diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index d82ae9a9f..c954c9eb6 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -16,12 +16,12 @@ jobs:
 
     name: dists & docs (${{ matrix.python-version }}/${{ matrix.language }})
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
 
       - name: Set up CPython ${{ matrix.python-version }}
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -35,9 +35,9 @@ jobs:
           python ./setup.py sdist bdist_wheel
 
       # - name: Upload artifacts
-      #   uses: actions/upload-artifact@v2
+      #   uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       #   with:
-      #     name: distributions
+      #     name: distributions-${{ matrix.python-version }}-${{ matrix.language }}
       #     path: dist/*
 
       - name: Install package
@@ -53,8 +53,8 @@ jobs:
           DOCS_LANGUAGE: ${{ matrix.language }}
 
       # - name: Upload docs
-      #   uses: actions/upload-artifact@v2
+      #   uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       #   if: always()
       #   with:
-      #     name: docs-${{ matrix.language }}
+      #     name: docs-${{ matrix.python-version }}-${{ matrix.language }}
       #     path: docs/_build/html/*
diff --git a/.github/workflows/crowdin_download.yml b/.github/workflows/crowdin_download.yml
index 2e02428b7..9a7653b04 100644
--- a/.github/workflows/crowdin_download.yml
+++ b/.github/workflows/crowdin_download.yml
@@ -27,7 +27,7 @@ jobs:
     environment: Crowdin
     name: download
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
           ref: master
@@ -49,7 +49,7 @@ jobs:
 
       - name: Create pull request
         id: cpr_crowdin
-        uses: peter-evans/create-pull-request@v3
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           commit-message: Crowdin translations download
@@ -60,7 +60,7 @@ jobs:
           author: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
 
       - name: Close and reopen the PR with different token to trigger CI
-        uses: actions/github-script@v3
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           PR_NUMBER: ${{ steps.cpr_crowdin.outputs.pull-request-number }}
           PR_OPERATION: ${{ steps.cpr_crowdin.outputs.pull-request-operation }}
diff --git a/.github/workflows/crowdin_upload.yml b/.github/workflows/crowdin_upload.yml
index 949528b8e..e5b393040 100644
--- a/.github/workflows/crowdin_upload.yml
+++ b/.github/workflows/crowdin_upload.yml
@@ -9,12 +9,12 @@ jobs:
     environment: Crowdin
     name: upload
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
 
       - name: Set up CPython 3.x
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: 3.x
 
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 2c9f648a8..78d5d5ef1 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -15,12 +15,12 @@ jobs:
 
     name: check ${{ matrix.python-version }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
 
       - name: Set up CPython ${{ matrix.python-version }}
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -31,12 +31,12 @@ jobs:
           pip install -U -r requirements.txt
 
       - name: Setup node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '16'
 
       - name: Run Pyright
-        uses: jakebailey/pyright-action@v1
+        uses: jakebailey/pyright-action@8ec14b5cfe41f26e5f41686a31eb6012758217ef # v3.0.2
         with:
           version: '1.1.394'
           warnings: false
diff --git a/.github/workflows/scripts/close_and_reopen_pr.js b/.github/workflows/scripts/close_and_reopen_pr.js
index dc1214301..fb210ccdb 100644
--- a/.github/workflows/scripts/close_and_reopen_pr.js
+++ b/.github/workflows/scripts/close_and_reopen_pr.js
@@ -12,7 +12,7 @@ module.exports = (async function ({github, context}) {
         await new Promise(r => setTimeout(r, 5000));
 
         // Close the PR
-        github.issues.update({
+        await github.rest.issues.update({
             issue_number: pr_number,
             owner: context.repo.owner,
             repo: context.repo.repo,
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index f81a384a1..9ab004aea 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -15,12 +15,12 @@ jobs:
 
     name: pytest ${{ matrix.python-version }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
 
       - name: Set up CPython ${{ matrix.python-version }}
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{ matrix.python-version }}