diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
new file mode 100644
index 0000000..19f87b9
--- /dev/null
+++ b/.github/workflows/actions.lock
@@ -0,0 +1,34 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/ci.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'oven-sh/setup-bun@v2.2.0'
+    '.github/workflows/release.yml':
+        - 'actions/checkout@v7.0.1'
+        - 'actions/setup-node@v7.1.0'
+        - 'changesets/action@v1.9.0'
+        - 'oven-sh/setup-bun@v2.2.0'
+dependencies:
+    'actions/checkout@v7.0.1':
+        ref: 'v7.0.1'
+        commit: 'sha1-3d3c42e5aac5ba805825da76410c181273ba90b1'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/setup-node@v7.1.0':
+        ref: 'v7.1.0'
+        commit: 'sha1-949feb2413d6458794dcd2491c4babbbce0c15c1'
+        owner_id: 44036562
+        repo_id: 189476904
+    'changesets/action@v1.9.0':
+        ref: 'v1.9.0'
+        commit: 'sha1-a45c4d594aa4e2c509dc14a9f2b3b67ba3780d0d'
+        owner_id: 51163350
+        repo_id: 202093906
+    'oven-sh/setup-bun@v2.2.0':
+        ref: 'v2.2.0'
+        commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6'
+        owner_id: 108928776
+        repo_id: 512644635
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 60e944c..6fb576f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,9 +10,9 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7.0.1
 
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@v2.2.0
         with:
           bun-version: 1.3.13
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a83174e..4357ece 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -15,9 +15,9 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7.0.1
 
-      - uses: oven-sh/setup-bun@v2
+      - uses: oven-sh/setup-bun@v2.2.0
         with:
           bun-version: 1.3.13
 
@@ -25,7 +25,7 @@ jobs:
       # special-cases pnpm; everything else, incl. bun, uses npm). npm performs
       # the OIDC token exchange for Trusted Publishing, so install a recent
       # Node/npm and point publishing at npmjs.
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v7.1.0
         with:
           node-version: 24
           registry-url: https://registry.npmjs.org
@@ -42,7 +42,7 @@ jobs:
       # have a Trusted Publisher configured on npmjs (repo: Love-Rox/ptpt,
       # workflow: release.yml). No NPM_TOKEN secret is used.
       - name: Changesets
-        uses: changesets/action@v1
+        uses: changesets/action@v1.9.0
         with:
           version: bun run version
           publish: bun run release