diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7382b3bf..3c697828 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -14,7 +14,7 @@ jobs:
       matrix:
         operating-system: [ubuntu-22.04, ubuntu-24.04, ubuntu-24.04-arm]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: Does init() in platform/src/lib.rs contain all roc_fx functions? (Imperfect check)
         run: cat platform/src/lib.rs | grep -oP 'roc_fx_[^(\s]*' | sort | uniq -u | grep -q . && exit 1 || exit 0
diff --git a/.github/workflows/ci_nix.yml b/.github/workflows/ci_nix.yml
index 0402807e..41386752 100644
--- a/.github/workflows/ci_nix.yml
+++ b/.github/workflows/ci_nix.yml
@@ -16,14 +16,14 @@ jobs:
         os: [macos-13, macos-14, ubuntu-22.04, ubuntu-24.04-arm]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       # install nix
-      - uses: cachix/install-nix-action@v23
+      - uses: cachix/install-nix-action@02a151ada4993995686f9ed4f1be7cfbb229e56f # commit for v31
         with:
           nix_path: nixpkgs=channel:nixos-unstable
 
-      - uses: cachix/cachix-action@v12
+      - uses: cachix/cachix-action@0fc020193b5a1fa3ac4575aa3a7d3aa6a35435ad # commit for v16
         with:
           name: enigmaticsunrise
           authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
diff --git a/.github/workflows/test_latest_release.yml b/.github/workflows/test_latest_release.yml
index 49e0beef..64b1c4cb 100644
--- a/.github/workflows/test_latest_release.yml
+++ b/.github/workflows/test_latest_release.yml
@@ -10,7 +10,7 @@ jobs:
   test-latest-release:
     runs-on: [ubuntu-22.04]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v4
 
       - name: remove everything except some ci scripts
         run: |