diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b3298175e7..c09bb0bd27 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ${{ matrix.os }}
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
     - name: Install greadlink
       if: startsWith(runner.os, 'macOS')
       run: brew install coreutils
@@ -26,11 +26,11 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
     - name: Set up Python
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       with:
-        python-version: 3.8
+        python-version: 3.12
     - name: Install docs dependencies
       run: python3 -m pip install -r docs/requirements.txt
     - name: Build the docs
@@ -40,15 +40,15 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
     - name: Set up Go
-      uses: actions/setup-go@v4
+      uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
       with:
-        go-version: 1.21.0
+        go-version: 1.25.8
     - name: Set up Python
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       with:
-        python-version: 3.8
+        python-version: 3.12
     - name: Install shfmt
       run: go install mvdan.cc/sh/v3/cmd/shfmt@latest
     - name: Install shellcheck
@@ -71,12 +71,12 @@ jobs:
 
     steps:
       - name: Repository checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 
       - id: ShellCheck
         name: Differential ShellCheck
-        uses: redhat-plumbers-in-action/differential-shellcheck@v5
+        uses: redhat-plumbers-in-action/differential-shellcheck@d965e66ec0b3b2f821f75c8eff9b12442d9a7d1e # v5.5.6
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index b8615c4d14..92f2686e8b 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -6,7 +6,7 @@ minimum_pre_commit_version: 1.18.1
 exclude: "docs/_build/|vendor/"
 repos:
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v2.3.0
+    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c  # frozen: v6.0.0
     hooks:
       - id: trailing-whitespace
         exclude: ".(md|rst)$"
@@ -15,14 +15,14 @@ repos:
       - id: mixed-line-ending
       - id: check-added-large-files
   - repo: https://github.com/jumanjihouse/pre-commit-hooks
-    rev: 2.1.5
+    rev: 38980559e3a605691d6579f96222c30778e5a69e  # frozen: 3.0.0
     hooks:
       - id: git-check  # Configure in .gitattributes
       - id: shellcheck
         files: "\\.(bash)$"
       - id: shfmt
   - repo: https://github.com/Lucas-C/pre-commit-hooks
-    rev: v1.1.7
+    rev: ad1b27d73581aa16cca06fc4a0761fc563ffe8e8  # frozen: v1.5.6
     hooks:
       # - id: forbid-crlf
       - id: remove-crlf
diff --git a/docs/requirements.txt b/docs/requirements.txt
index 7b7fcdd1ff..2a806fe0ab 100644
--- a/docs/requirements.txt
+++ b/docs/requirements.txt
@@ -1,4 +1,4 @@
-sphinx==4.5.0
-sphinx-rtd-theme==0.5.0
-sphinxemoji==0.1.8
-docutils==0.17.1
+sphinx==9.1.0
+sphinx-rtd-theme==3.1.0
+sphinxemoji==0.3.2
+docutils==0.22.4
diff --git a/test/lint-requirements.txt b/test/lint-requirements.txt
index 72224bf87c..fc23792238 100644
--- a/test/lint-requirements.txt
+++ b/test/lint-requirements.txt
@@ -1 +1 @@
-pre-commit==2.3.0
+pre-commit==4.5.1