diff --git a/.github/workflows/actions/prepare/action.yml b/.github/workflows/actions/prepare/action.yml
index 442ca6f403..56a2def66b 100644
--- a/.github/workflows/actions/prepare/action.yml
+++ b/.github/workflows/actions/prepare/action.yml
@@ -2,8 +2,10 @@ name: Prepare repo
 runs:
   using: 'composite'
   steps:
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       name: Setup node.js and yarn
+      env:
+        NODE_AUTH_TOKEN: ''
       with:
         registry-url: 'https://registry.npmjs.org' # Required for OIDC
         cache: yarn
diff --git a/.github/workflows/changesets-reminder.yml b/.github/workflows/changesets-reminder.yml
index bf70be3653..58f0453266 100644
--- a/.github/workflows/changesets-reminder.yml
+++ b/.github/workflows/changesets-reminder.yml
@@ -30,7 +30,7 @@ jobs:
     timeout-minutes: 2
     if: ${{ !github.event.pull_request.draft && !startsWith(github.head_ref, 'changeset-release/') }}
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: mskelton/changelog-reminder-action@7039cd14fb784c0a2b37f6e7a6ade2c9148c2245 # v2.0.0
         with:
           changelogRegex: "\\.changeset"
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9c15bed9cc..10731b9ca7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,7 +6,7 @@ jobs:
   type-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: ./.github/workflows/actions/prepare
 
       - id: typescript-cache
@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: ./.github/workflows/actions/prepare
 
       - id: eslint-cache
@@ -46,7 +46,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: ./.github/workflows/actions/prepare
 
       - name: Build packages
@@ -89,7 +89,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - uses: ./.github/workflows/actions/prepare
 
       - id: test-build
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index e80befdd62..2da9777f98 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -34,7 +34,7 @@ jobs:
     steps:
       # WARNING: DO NOT RUN ANY CUSTOM LOCAL SCRIPT BEFORE RUNNING THE SNAPIT ACTION
       # This action can be executed by 3rd party users and it should not be able to run arbitrary code from a PR.
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           token: ${{ secrets.SHOPIFY_GH_ACCESS_TOKEN }}
 
@@ -62,7 +62,7 @@ jobs:
       contents: read
       id-token: write # Required for OIDC
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           token: ${{ secrets.SHOPIFY_GH_ACCESS_TOKEN }}
 
diff --git a/.github/workflows/internal-snapshot.yml b/.github/workflows/internal-snapshot.yml
index 564ee60ab6..45a3b36347 100644
--- a/.github/workflows/internal-snapshot.yml
+++ b/.github/workflows/internal-snapshot.yml
@@ -13,7 +13,7 @@ jobs:
     name: Internal Snapshot
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           token: ${{ secrets.SHOPIFY_GH_ACCESS_TOKEN }}
 
diff --git a/.github/workflows/unstable-snapshot.yml b/.github/workflows/unstable-snapshot.yml
index bc1a57536f..d3a3db55ef 100644
--- a/.github/workflows/unstable-snapshot.yml
+++ b/.github/workflows/unstable-snapshot.yml
@@ -13,7 +13,7 @@ jobs:
     name: Unstable Snapshot
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           token: ${{ secrets.SHOPIFY_GH_ACCESS_TOKEN }}