diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a14d928..86cd386 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,7 +24,7 @@ jobs:
       - uses: actions/checkout@v7
         with:
           fetch-depth: 0   # need history to diff against the base ref
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@v7
         with:
           python-version: '3.12'
       - run: pip install pre-commit
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 31ba790..919562c 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -32,7 +32,7 @@ jobs:
           sudo apt-get install -y cmake ninja-build g++ libopenmpi-dev openmpi-bin libomp-dev
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@v4.37.3
         with:
           languages: c-cpp
           queries: security-and-quality
@@ -45,6 +45,6 @@ jobs:
           cmake --build build -j
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@v4.37.3
         with:
           category: "/language:c-cpp"