diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 374f5da..0eb03c5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -54,7 +54,7 @@ jobs:
           node-version-file: ".nvmrc"
 
       - name: Cache node_modules
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         id: node-modules-cache
         with:
           path: node_modules
@@ -85,7 +85,7 @@ jobs:
           node-version-file: ".nvmrc"
 
       - name: Cache node_modules
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         id: node-modules-cache
         with:
           path: node_modules
@@ -116,7 +116,7 @@ jobs:
           node-version-file: ".nvmrc"
 
       - name: Cache node_modules
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         id: node-modules-cache
         with:
           path: node_modules
@@ -147,7 +147,7 @@ jobs:
           node-version-file: ".nvmrc"
 
       - name: Cache node_modules
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         id: node-modules-cache
         with:
           path: node_modules
@@ -178,7 +178,7 @@ jobs:
           node-version-file: ".nvmrc"
 
       - name: Cache node_modules
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         id: node-modules-cache
         with:
           path: node_modules
@@ -214,7 +214,7 @@ jobs:
           echo "[Download Coverage Artifact](${{ steps.upload-coverage.outputs.artifact-url }})" >> "$GITHUB_STEP_SUMMARY"
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: ./coverage/lcov.info
@@ -226,7 +226,7 @@ jobs:
 
       - name: Upload test results to Codecov
         if: ${{ !cancelled() }}
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
+        uses: codecov/codecov-action@1af58845a975a7985b0beb0cbe6fbbb71a41dbad # v5.5.3
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           files: ./coverage/test-report.junit.xml
@@ -253,7 +253,7 @@ jobs:
           node-version-file: ".nvmrc"
 
       - name: Cache node_modules
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         id: node-modules-cache
         with:
           path: node_modules
diff --git a/.github/workflows/claude-pr-review.yml b/.github/workflows/claude-pr-review.yml
index 98a48c7..a71fc37 100644
--- a/.github/workflows/claude-pr-review.yml
+++ b/.github/workflows/claude-pr-review.yml
@@ -40,7 +40,7 @@ jobs:
           node-version-file: ".nvmrc"
 
       - name: Cache node_modules
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         id: node-modules-cache
         with:
           path: node_modules
diff --git a/.github/workflows/links.yml b/.github/workflows/links.yml
index e771a44..43cd900 100644
--- a/.github/workflows/links.yml
+++ b/.github/workflows/links.yml
@@ -38,7 +38,7 @@ jobs:
       # Split restore/save pattern ensures cache is saved even on failure
       - name: Restore lychee cache
         id: restore-cache
-        uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache/restore@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         with:
           path: .lycheecache
           key: cache-lychee-v1
@@ -58,7 +58,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Save lychee cache
-        uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
+        uses: actions/cache/save@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5.0.4
         if: always()
         with:
           path: .lycheecache