diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 1e33d06..cfa95fe 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -9,27 +9,28 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout code
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      uses: actions/checkout@v7.0.1
     - name: Install Lix
-      uses: samueldr/lix-gha-installer-action@7b7f14d320d6aacfb65bd1ef761566b3b69e474c
+      uses: samueldr/lix-gha-installer-action@v2026-06-15
       with:
         extra_nix_config: |-
           accept-flake-config = true
           max-jobs = auto
     - name: Add SSH keys to ssh-agent
-      uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555
+      uses: webfactory/ssh-agent@v0.10.0
       with:
         ssh-private-key: |-
           ${{ secrets.SECRETS_DEPLOY_KEY }}
           ${{ secrets.PRAGMATAPRO_DEPLOY_KEY }}
     - name: Setup Attic cache
-      uses: ryanccn/attic-action@1887fd507f03327c96c64cca30118c96eb17fdad
+      uses: ryanccn/attic-action@v0.4
       with:
         cache: tilde
         endpoint: https://cache.e10.camp
+        install-command: nix profile install github:NixOS/nixpkgs/nixpkgs-unstable#attic-client
         token: ${{ secrets.ATTIC_TOKEN }}
     - name: Use Cachix store
-      uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c
+      uses: cachix/cachix-action@v17
       with:
         authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
         installCommand: nix profile install github:NixOS/nixpkgs/nixpkgs-unstable#cachix
diff --git a/.github/workflows/devshell.yml b/.github/workflows/devshell.yml
index 001f32f..1b270f3 100644
--- a/.github/workflows/devshell.yml
+++ b/.github/workflows/devshell.yml
@@ -9,27 +9,28 @@ jobs:
     runs-on: macos-15
     steps:
     - name: Checkout code
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      uses: actions/checkout@v7.0.1
     - name: Install Lix
-      uses: samueldr/lix-gha-installer-action@7b7f14d320d6aacfb65bd1ef761566b3b69e474c
+      uses: samueldr/lix-gha-installer-action@v2026-06-15
       with:
         extra_nix_config: |-
           accept-flake-config = true
           max-jobs = auto
     - name: Add SSH keys to ssh-agent
-      uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555
+      uses: webfactory/ssh-agent@v0.10.0
       with:
         ssh-private-key: |-
           ${{ secrets.SECRETS_DEPLOY_KEY }}
           ${{ secrets.PRAGMATAPRO_DEPLOY_KEY }}
     - name: Setup Attic cache
-      uses: ryanccn/attic-action@1887fd507f03327c96c64cca30118c96eb17fdad
+      uses: ryanccn/attic-action@v0.4
       with:
         cache: tilde
         endpoint: https://cache.e10.camp
+        install-command: nix profile install github:NixOS/nixpkgs/nixpkgs-unstable#attic-client
         token: ${{ secrets.ATTIC_TOKEN }}
     - name: Use Cachix store
-      uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c
+      uses: cachix/cachix-action@v17
       with:
         authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
         installCommand: nix profile install github:NixOS/nixpkgs/nixpkgs-unstable#cachix
diff --git a/.github/workflows/hosts.yml b/.github/workflows/hosts.yml
index 70efce8..23af742 100644
--- a/.github/workflows/hosts.yml
+++ b/.github/workflows/hosts.yml
@@ -9,27 +9,28 @@ jobs:
     runs-on: macos-15
     steps:
     - name: Checkout code
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      uses: actions/checkout@v7.0.1
     - name: Install Lix
-      uses: samueldr/lix-gha-installer-action@7b7f14d320d6aacfb65bd1ef761566b3b69e474c
+      uses: samueldr/lix-gha-installer-action@v2026-06-15
       with:
         extra_nix_config: |-
           accept-flake-config = true
           max-jobs = auto
     - name: Add SSH keys to ssh-agent
-      uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555
+      uses: webfactory/ssh-agent@v0.10.0
       with:
         ssh-private-key: |-
           ${{ secrets.SECRETS_DEPLOY_KEY }}
           ${{ secrets.PRAGMATAPRO_DEPLOY_KEY }}
     - name: Setup Attic cache
-      uses: ryanccn/attic-action@1887fd507f03327c96c64cca30118c96eb17fdad
+      uses: ryanccn/attic-action@v0.4
       with:
         cache: tilde
         endpoint: https://cache.e10.camp
+        install-command: nix profile install github:NixOS/nixpkgs/nixpkgs-unstable#attic-client
         token: ${{ secrets.ATTIC_TOKEN }}
     - name: Use Cachix store
-      uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c
+      uses: cachix/cachix-action@v17
       with:
         authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
         installCommand: nix profile install github:NixOS/nixpkgs/nixpkgs-unstable#cachix
diff --git a/.github/workflows/packages.yml b/.github/workflows/packages.yml
index 895b26a..ef957d5 100644
--- a/.github/workflows/packages.yml
+++ b/.github/workflows/packages.yml
@@ -9,27 +9,28 @@ jobs:
     runs-on: macos-15
     steps:
     - name: Checkout code
-      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      uses: actions/checkout@v7.0.1
     - name: Install Lix
-      uses: samueldr/lix-gha-installer-action@7b7f14d320d6aacfb65bd1ef761566b3b69e474c
+      uses: samueldr/lix-gha-installer-action@v2026-06-15
       with:
         extra_nix_config: |-
           accept-flake-config = true
           max-jobs = auto
     - name: Add SSH keys to ssh-agent
-      uses: webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555
+      uses: webfactory/ssh-agent@v0.10.0
       with:
         ssh-private-key: |-
           ${{ secrets.SECRETS_DEPLOY_KEY }}
           ${{ secrets.PRAGMATAPRO_DEPLOY_KEY }}
     - name: Setup Attic cache
-      uses: ryanccn/attic-action@1887fd507f03327c96c64cca30118c96eb17fdad
+      uses: ryanccn/attic-action@v0.4
       with:
         cache: tilde
         endpoint: https://cache.e10.camp
+        install-command: nix profile install github:NixOS/nixpkgs/nixpkgs-unstable#attic-client
         token: ${{ secrets.ATTIC_TOKEN }}
     - name: Use Cachix store
-      uses: cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c
+      uses: cachix/cachix-action@v17
       with:
         authToken: ${{ secrets.CACHIX_AUTH_TOKEN }}
         installCommand: nix profile install github:NixOS/nixpkgs/nixpkgs-unstable#cachix
diff --git a/modules/development/ci.nix b/modules/development/ci.nix
index d8decb0..6a8433b 100644
--- a/modules/development/ci.nix
+++ b/modules/development/ci.nix
@@ -8,11 +8,11 @@ in
   flake.actions-nix.workflows =
     let
       actions = {
-        checkout = "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd";
-        install-lix = "samueldr/lix-gha-installer-action@7b7f14d320d6aacfb65bd1ef761566b3b69e474c";
-        ssh-agent = "webfactory/ssh-agent@e83874834305fe9a4a2997156cb26c5de65a8555";
-        attic = "ryanccn/attic-action@1887fd507f03327c96c64cca30118c96eb17fdad";
-        cachix = "cachix/cachix-action@1eb2ef646ac0255473d23a5907ad7b04ce94065c";
+        checkout = "actions/checkout@v7.0.1";
+        install-lix = "samueldr/lix-gha-installer-action@v2026-06-15";
+        ssh-agent = "webfactory/ssh-agent@v0.10.0";
+        attic = "ryanccn/attic-action@v0.4";
+        cachix = "cachix/cachix-action@v17";
       };
       setup = [
         {
@@ -43,6 +43,7 @@ in
           name = "Setup Attic cache";
           uses = actions.attic;
           "with" = {
+            install-command = "nix profile install github:NixOS/nixpkgs/nixpkgs-unstable#attic-client";
             cache = "tilde";
             endpoint = "https://cache.e10.camp";
             token = "\${{ secrets.ATTIC_TOKEN }}";