diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 234dc416b8f1..3d1d59355f70 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -36,7 +36,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version: 24.14.0
+          node-version: 24.14.1
           cache: "pnpm"
 
       - name: Install dependencies
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 95038d18cf40..32068609d8f0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -124,7 +124,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version: 24.14.0
+          node-version: 24.14.1
           cache: "pnpm"
 
       - name: Install dependencies
diff --git a/.github/workflows/congrats.yml b/.github/workflows/congrats.yml
index 4052bdac8776..6ad87c9ce9a1 100644
--- a/.github/workflows/congrats.yml
+++ b/.github/workflows/congrats.yml
@@ -9,7 +9,7 @@ jobs:
   congrats:
     name: congratsbot
     if: ${{ github.repository_owner == 'withastro' && github.event.head_commit.message != '[ci] format' }}
-    uses: withastro/automation/.github/workflows/congratsbot.yml@main
+    uses: withastro/automation/.github/workflows/congratsbot.yml@a5bd0c5748c4d56e687cdd558064f9ee8adfb1f2 # main
     with:
       EMOJIS: '🎉,🎊,🧑‍🚀,🥳,🙌,🚀,👏,<:houston_golden:1068575433647456447>,<:astrocoin:894990669515489301>,<:astro_pride:1130501345326157854>'
     secrets:
diff --git a/.github/workflows/continuous_benchmark.yml b/.github/workflows/continuous_benchmark.yml
index 6eae291930a4..3e3f2e89a12a 100644
--- a/.github/workflows/continuous_benchmark.yml
+++ b/.github/workflows/continuous_benchmark.yml
@@ -41,7 +41,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version: 24.14.0
+          node-version: 24.14.1
           cache: "pnpm"
 
       - name: Install dependencies
@@ -56,7 +56,7 @@ jobs:
         timeout-minutes: 15
         
       - name: Run the benchmarks
-        uses: CodSpeedHQ/action@1c8ae4843586d3ba879736b7f6b7b0c990757fab # v4.12.1
+        uses: CodSpeedHQ/action@db35df748deb45fdef0960669f57d627c1956c30 # v4.13.1
         timeout-minutes: 30
         with:
           working-directory: ./benchmark
diff --git a/.github/workflows/diff-dependencies.yml b/.github/workflows/diff-dependencies.yml
index d48c503d2465..8809e4d3c55d 100644
--- a/.github/workflows/diff-dependencies.yml
+++ b/.github/workflows/diff-dependencies.yml
@@ -20,7 +20,7 @@ jobs:
           fetch-depth: 0 # allows the diff action to access git history
 
       - name: Create Diff
-        uses: e18e/action-dependency-diff@d995338f3b229fe7b2cd82048df5da930f70c7c3 # v1.4.4
+        uses: e18e/action-dependency-diff@5d3c6ac2ad2de2eaca1dc120c5accfd9590764b6 # v1.5.1
         with:
           # We’re using this package primarily to track size changes, not as worried about duplicates
           duplicate-threshold: 100
diff --git a/.github/workflows/format.yml b/.github/workflows/format.yml
index 9faaa1886608..656ac1b6dbe7 100644
--- a/.github/workflows/format.yml
+++ b/.github/workflows/format.yml
@@ -9,7 +9,7 @@ on:
 jobs:
   prettier:
     if: github.repository_owner == 'withastro'
-    uses: withastro/automation/.github/workflows/format.yml@main
+    uses: withastro/automation/.github/workflows/format.yml@a5bd0c5748c4d56e687cdd558064f9ee8adfb1f2 # main
     with:
       command: "format"
     secrets: inherit
diff --git a/.github/workflows/issue-triage.yml b/.github/workflows/issue-triage.yml
index ca57bdde12da..096b5ceb9e94 100644
--- a/.github/workflows/issue-triage.yml
+++ b/.github/workflows/issue-triage.yml
@@ -72,7 +72,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version: 24.14.0
+          node-version: 24.14.1
           cache: pnpm
 
       - name: Clone Astro Compiler (for debugging)
diff --git a/.github/workflows/preview-release.yml b/.github/workflows/preview-release.yml
index 2506fafbde12..3992a0e7d598 100644
--- a/.github/workflows/preview-release.yml
+++ b/.github/workflows/preview-release.yml
@@ -48,7 +48,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version: 24.14.0
+          node-version: 24.14.1
           cache: "pnpm"
 
       - name: Install dependencies
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index af1d80d65d5e..dd35b0baa3d0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -36,7 +36,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version: 24.14.0
+          node-version: 24.14.1
           cache: "pnpm"
 
       - name: Install dependencies
diff --git a/.github/workflows/scripts.yml b/.github/workflows/scripts.yml
index 01ad219dd8cb..68ed1dd565e6 100644
--- a/.github/workflows/scripts.yml
+++ b/.github/workflows/scripts.yml
@@ -38,7 +38,7 @@ jobs:
       - name: Setup Node
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
-          node-version: 24.14.0
+          node-version: 24.14.1
           cache: "pnpm"
 
       - name: Install dependencies
diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index c34308602e4f..7d6b1d7060d3 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -10,5 +10,5 @@ jobs:
     container:
       image: semgrep/semgrep@sha256:500acf49f5e5785aa89af609b983f0427ac8cd08f7e34146277df6cffb002759 # v1.157.0
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8  # v5.0.0
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd  # v5.0.1
       - run: semgrep scan --config=auto