diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d5a4f21..96aece9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -28,10 +28,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Use Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: lts/*
 
@@ -54,16 +54,16 @@ jobs:
     needs: lint-test-and-build
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 20.20.0
           registry-url: 'https://registry.npmjs.org'
 
       - name: get-package-info
         id: package
-        uses: codex-team/action-nodejs-package-info@v1.1
+        uses: codex-team/action-nodejs-package-info@91c20c2872fd5d1a6fe97d606d9dcb6553696185 # v1.1
 
       - name: Check node versions
         id: online-versions
diff --git a/package-lock.json b/package-lock.json
index cf54525..3ab33fa 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -23,7 +23,7 @@
         "opn": "5.5.0",
         "rimraf": "6.1.2",
         "tar": "7.5.7",
-        "zod": "^4.3.6"
+        "zod": "4.3.6"
       },
       "bin": {
         "lxr": "bin/lxr"
diff --git a/package.json b/package.json
index 5bbf995..643dabc 100644
--- a/package.json
+++ b/package.json
@@ -46,7 +46,7 @@
     "opn": "5.5.0",
     "rimraf": "6.1.2",
     "tar": "7.5.7",
-    "zod": "^4.3.6"
+    "zod": "4.3.6"
   },
   "devDependencies": {
     "@antfu/eslint-config": "4.19.0",