diff --git a/.forgejo/workflows/check.yml b/.forgejo/workflows/check.yml
index db35de7..8f408ba 100644
--- a/.forgejo/workflows/check.yml
+++ b/.forgejo/workflows/check.yml
@@ -13,7 +13,7 @@ jobs:
           - nvimNoTSGrammars
           - treefmt
     steps:
-      - uses: "https://git.salame.cl/actions/checkout@v4"
+      - uses: "https://git.salame.cl/actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683" # v4
       - name: Run checks
         run: |
           nix --version
@@ -22,7 +22,7 @@ jobs:
   check-renovaterc:
     runs-on: nixos
     steps:
-      - uses: "https://git.salame.cl/actions/checkout@v4"
+      - uses: "https://git.salame.cl/actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683" # v4
       - name: Validate renovaterc.json
         run: |
           nix --version
@@ -39,7 +39,7 @@ jobs:
           - nixosConfigurations.vm.config.system.build.toplevel
           - nvim
     steps:
-      - uses: "https://git.salame.cl/actions/checkout@v4"
+      - uses: "https://git.salame.cl/actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683" # v4
       - name: Build target
         run: |
           nix --version
@@ -49,7 +49,7 @@ jobs:
     runs-on: nixos
     needs: build
     steps:
-      - uses: "https://git.salame.cl/actions/checkout@v4"
+      - uses: "https://git.salame.cl/actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683" # v4
       - run: nix --version
       - name: Create Size Report
         uses: https://git.salame.cl/jalil/nix-flake-outputs-size@main
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index 499a8c3..dd7df12 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -11,12 +11,12 @@ jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - uses:  DeterminateSystems/nix-installer-action@v13
         with:
           source-url: "https://install.lix.systems/lix/lix-installer-x86_64-linux"
           diagnostic-endpoint: ""
-      - uses: DeterminateSystems/magic-nix-cache-action@v9
+      - uses: DeterminateSystems/magic-nix-cache-action@6221693898146dc97e38ad0e013488a16477a4c4 # v9
       - name: Run `nix flake check`
         run: |
           nix flake check --verbose --keep-going
@@ -24,8 +24,8 @@ jobs:
   build-docs:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: DeterminateSystems/magic-nix-cache-action@v9
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: DeterminateSystems/magic-nix-cache-action@6221693898146dc97e38ad0e013488a16477a4c4 # v9
       - uses:  DeterminateSystems/nix-installer-action@v13
         with:
           source-url: "https://install.lix.systems/lix/lix-installer-x86_64-linux"
@@ -33,7 +33,7 @@ jobs:
       - name: Build documentation
         run: nix build .#docs --print-build-logs
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
         with:
           path: ./result
   deploy-docs:
@@ -49,4 +49,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
diff --git a/scripts/audiomenu/Cargo.lock b/scripts/audiomenu/Cargo.lock
index 66f9c78..428412c 100644
--- a/scripts/audiomenu/Cargo.lock
+++ b/scripts/audiomenu/Cargo.lock
@@ -346,18 +346,18 @@ checksum = "28d3b2b1366ec20994f1fd18c3c594f05c5dd4bc44d8bb0c1c632c8d6829481f"
 
 [[package]]
 name = "serde"
-version = "1.0.218"
+version = "1.0.219"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8dfc9d19bdbf6d17e22319da49161d5d0108e4188e8b680aef6299eed22df60"
+checksum = "5f0e2c6ed6606019b4e29e69dbaba95b11854410e5347d525002456dbbb786b6"
 dependencies = [
  "serde_derive",
 ]
 
 [[package]]
 name = "serde_derive"
-version = "1.0.218"
+version = "1.0.219"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f09503e191f4e797cb8aac08e9a4a4695c5edf6a2e70e376d961ddd5c969f82b"
+checksum = "5b0276cf7f2c73365f7157c8123c21cd9a50fbbd844757af28ca1f5925fc2a00"
 dependencies = [
  "proc-macro2",
  "quote",