diff --git a/.github/workflows/env-checks.yml b/.github/workflows/env-checks.yml
index 285b42804..be709ab2a 100644
--- a/.github/workflows/env-checks.yml
+++ b/.github/workflows/env-checks.yml
@@ -43,11 +43,15 @@ jobs:
         matrix:
             os: [macos-latest, ubuntu-latest, windows-latest]
             python-version: ["3.7", "3.8", "3.9"]
+            exclude:
+              # macOS arm runners don't have native build for 3.7
+              - os: macos-latest
+                python-version: "3.7"
 
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
       # checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
       
       # remove the Python version from the file for testing
       - name: strip hardcoded Python version from environment for testing
@@ -59,12 +63,11 @@ jobs:
           fi;
 
       # create the conda env
-      - uses: conda-incubator/setup-miniconda@v2
+      - uses: conda-incubator/setup-miniconda@a4260408e20b96e80095f42ff7f1a15b27dd94ca  # v3.0.4
         with:
           python-version: ${{ matrix.python-version }}
           auto-update-conda: true
-          miniforge-variant: Mambaforge
-          use-mamba: true
+          channels: conda-forge
           channel-priority: true
           activate-environment: book_env
           environment-file: environment.yml