diff --git a/.github/workflows/deploy-preview.yaml b/.github/workflows/deploy-preview.yaml
index 225336d..25f262a 100644
--- a/.github/workflows/deploy-preview.yaml
+++ b/.github/workflows/deploy-preview.yaml
@@ -55,7 +55,7 @@ jobs:
           poetry run python bin/website build
 
       - name: Start Deployment
-        uses: bobheadxi/deployments@v1
+        uses: bobheadxi/deployments@648679e8e4915b27893bd7dbc35cb504dc915bc8 # v1.5.0
         id: deployment
         with:
           step: start
diff --git a/.github/workflows/deploy-production.yaml b/.github/workflows/deploy-production.yaml
index a6e07ef..8724a08 100644
--- a/.github/workflows/deploy-production.yaml
+++ b/.github/workflows/deploy-production.yaml
@@ -41,7 +41,7 @@ jobs:
       # removes the vendor directory that is created by "bundle install"
       # https://github.com/fenneclab/hugo-bin/blob/a5500e4f622f46886947d3438243bd97cfe6c04c/lib/install.js#L28-L30
       - name: Setup Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@eaecf785f6a34567a6d97f686bbb7bccc1ac1e5c # v1.237.0
         with:
           ruby-version: 2.6
           bundler-cache: true
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index cbd32e7..f4d1bc0 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -19,7 +19,7 @@ repos:
       - id: check-docstring-first
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.9.6
+    rev: v0.11.7
     hooks:
       - id: ruff
       - id: ruff-format
@@ -33,6 +33,6 @@ repos:
           - prettier-plugin-go-template@0.0.15
 
   - repo: https://github.com/woodruffw/zizmor-pre-commit
-    rev: v1.3.1
+    rev: v1.6.0
     hooks:
       - id: zizmor