diff --git a/.github/workflows/audit.yml b/.github/workflows/audit.yml
index b9fbf82..2fee6d6 100644
--- a/.github/workflows/audit.yml
+++ b/.github/workflows/audit.yml
@@ -22,10 +22,10 @@ jobs:
   audit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v4.4.0
+      - uses: actions/setup-node@v4.4.0
         with:
-          node-version: "20"
+          node-version: "20.20.2"
       - name: Audit (high severity gate)
         run: npm audit --audit-level=high
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2710192..401c108 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -18,10 +18,10 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v4.4.0
+      - uses: actions/setup-node@v4.4.0
         with:
-          node-version: "20"
+          node-version: "20.20.2"
           cache: npm
       - run: npm ci
       - name: Typecheck