diff --git a/.github/actions/record/action.yml b/.github/actions/record/action.yml
index 3a5ac95..18ee43b 100644
--- a/.github/actions/record/action.yml
+++ b/.github/actions/record/action.yml
@@ -112,7 +112,7 @@ runs:
         "$DEST/bin/ffmpeg" -version | head -n 1
 
     - name: Cache Puppeteer browsers
-      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.cache/puppeteer
         key: ${{ runner.os }}-puppeteer-${{ hashFiles(format('{0}/package-lock.json', inputs.working-directory)) }}
@@ -219,7 +219,7 @@ runs:
       # normal outcome that must not fail the action, and upload-artifact with
       # if-no-files-found: error would fail it.
       if: always() && inputs.upload-artifact == 'true' && steps.clips.outputs.count != '' && steps.clips.outputs.count != '0'
-      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: ${{ inputs.artifact-name }}
         path: ${{ steps.resolve.outputs.upload-path }}
diff --git a/.github/actions/run/action.yml b/.github/actions/run/action.yml
index b159cb3..d9b78f1 100644
--- a/.github/actions/run/action.yml
+++ b/.github/actions/run/action.yml
@@ -37,7 +37,7 @@ runs:
   using: 'composite'
   steps:
     - name: Cache Puppeteer browsers
-      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.cache/puppeteer
         key: ${{ runner.os }}-puppeteer-${{ hashFiles(format('{0}/package-lock.json', inputs.working-directory)) }}
@@ -85,7 +85,7 @@ runs:
       # shard failed" from "this shard never ran", and it reports the gap as a
       # missing artifact instead of the real failure.
       if: always() && inputs.shard != '' && inputs.upload-report == 'true'
-      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: twd-run-${{ steps.shard.outputs.index }}
         path: ${{ inputs.working-directory }}/${{ inputs.report-dir }}
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index c94ce2b..75c6056 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -51,7 +51,7 @@ jobs:
         run: npx twd-js init public --save
 
       - name: Cache Puppeteer browsers
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cache/puppeteer
           key: ${{ runner.os }}-puppeteer-${{ hashFiles('package-lock.json') }}
@@ -128,7 +128,7 @@ jobs:
         run: npx twd-js init public --save
 
       - name: Cache Puppeteer browsers
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.cache/puppeteer
           key: ${{ runner.os }}-puppeteer-${{ hashFiles('package-lock.json') }}
@@ -152,7 +152,7 @@ jobs:
         # Always: a red shard must still upload, or merge cannot tell "this shard
         # failed" from "this shard never ran".
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: twd-run-${{ matrix.shard }}
           path: test-example-app/.twd/run
@@ -179,7 +179,7 @@ jobs:
         run: npm ci
 
       - name: Download shard reports
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: twd-run-*
           path: test-example-app/.twd/shards