diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index acb24cc..09f82e3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -28,17 +28,17 @@ jobs:
       run:
         working-directory: swiss
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7
         with:
           path: swiss
           persist-credentials: false
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7
         with:
           repository: modelsphere/model-catalog
           ref: ${{ env.CATALOG_REF }}
           path: swiss-catalog
           persist-credentials: false
-      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
+      - uses: actions/setup-go@v7
         with:
           go-version-file: swiss/go.mod
           cache-dependency-path: swiss/go.sum
@@ -54,7 +54,7 @@ jobs:
   gate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/checkout@v7
         with:
           persist-credentials: false
       - name: LICENSE is the Apache-2.0 text, unmodified
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 0ff5821..66cd73a 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -42,7 +42,7 @@ jobs:
       DOCKERHUB: ${{ secrets.DOCKERHUB_USERNAME != '' && secrets.DOCKERHUB_TOKEN != '' }}
     steps:
       - name: Check out, with the web/console submodule
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        uses: actions/checkout@v7
         with:
           submodules: true
           persist-credentials: false
@@ -78,11 +78,11 @@ jobs:
           fi
 
       - name: Set up Buildx
-        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
+        uses: docker/setup-buildx-action@v4
 
       - name: Log in to GHCR
         if: env.PUSH == 'true'
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@v4
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -90,13 +90,13 @@ jobs:
 
       - name: Log in to Docker Hub
         if: env.PUSH == 'true' && env.DOCKERHUB == 'true'
-        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Build and push the image
-        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
+        uses: docker/build-push-action@v7
         with:
           context: .
           platforms: linux/amd64
@@ -110,7 +110,7 @@ jobs:
           cache-to: type=gha,mode=max
 
       - name: Set up Helm
-        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
+        uses: azure/setup-helm@v5
         with:
           version: v4.3.0
 
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3b0b97e..a0f0fa9 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -15,9 +15,6 @@ under it.
   submodule.
 - `NOTICE` listing third-party components.
 
-### Changed
-- GitHub Actions pinned to commit SHAs.
-
 ### Fixed
 - The web UI is built from a console commit without the proprietary
   `@riseaicloud/ui` kit; images up to and including 0.6.1 embedded it.