diff --git a/.github/workflows/license.yml b/.github/workflows/license.yml
index e556b833ee..c518f02059 100644
--- a/.github/workflows/license.yml
+++ b/.github/workflows/license.yml
@@ -4,8 +4,10 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: ruby/setup-ruby@v1
+    - uses: actions/checkout@v4.3.0
+      with:
+        persist-credentials: false
+    - uses: ruby/setup-ruby@v1.263.0
       with:
         ruby-version: '3.4'
     - name: Check license headers
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index b58f70417e..3aa2d2099c 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -17,7 +17,9 @@ jobs:
         ruby: ['head', '3.2', '3.3', '3.4', 'jruby-9.3', 'jruby-9.4', 'jruby-10.0']
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v4.3.0
+      with:
+        persist-credentials: false
     - name: Increase system limits
       run: |
         sudo swapoff -a
@@ -27,7 +29,7 @@ jobs:
     - uses: elastic/elastic-github-actions/elasticsearch@master
       with:
         stack-version: 9.2.0-SNAPSHOT
-    - uses: ruby/setup-ruby@v1
+    - uses: ruby/setup-ruby@v1.263.0
       with:
         ruby-version: ${{ matrix.ruby }}
     - name: Build
diff --git a/.github/workflows/otel.yml b/.github/workflows/otel.yml
index 303964df47..08a7de02dd 100644
--- a/.github/workflows/otel.yml
+++ b/.github/workflows/otel.yml
@@ -19,7 +19,9 @@ jobs:
         ruby: ['3.4', 'jruby-9.4']
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.3.0
+        with:
+          persist-credentials: false
       - name: Increase system limits
         run: |
           sudo swapoff -a
@@ -29,7 +31,7 @@ jobs:
       - uses: elastic/elastic-github-actions/elasticsearch@master
         with:
           stack-version: 9.2.0-SNAPSHOT
-      - uses: ruby/setup-ruby@v1
+      - uses: ruby/setup-ruby@v1.263.0
         with:
           ruby-version: ${{ matrix.ruby }}
       - name: Build