diff --git a/.github/workflows/firebase-hosting-merge.yml b/.github/workflows/firebase-hosting-merge.yml
index c37c462e..f73368e6 100644
--- a/.github/workflows/firebase-hosting-merge.yml
+++ b/.github/workflows/firebase-hosting-merge.yml
@@ -3,6 +3,11 @@
 
 name: Deploy to Firebase Hosting on merge
 
+permissions:
+  deployments: write
+  statuses: write
+  checks: write
+
 on:
   push:
     branches:
@@ -13,17 +18,25 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          submodules: true
+
+      - name: Setup Node
+        # yamllint disable-line rule:line-length
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: '24.18.0'
 
-      - name: Update and Build
+      - name: Build
         run: |
-          git submodule update --init
           cd website
-          npm install
+          npm ci
           npm run build
 
       - name: Firebase Hosting
-        uses: FirebaseExtended/action-hosting-deploy@v0
+        # yamllint disable-line rule:line-length
+        uses: FirebaseExtended/action-hosting-deploy@500ac625ca2dd40cbd15f7659af953801858032a # v0.11.0
         with:
           repoToken: '${{ secrets.GITHUB_TOKEN }}'
           firebaseServiceAccount: '${{ secrets.FIREBASE_SERVICE_ACCOUNT_GOLIOTH }}'
diff --git a/.github/workflows/firebase-hosting-pull-request.yml b/.github/workflows/firebase-hosting-pull-request.yml
index 357ead38..0867e7d4 100644
--- a/.github/workflows/firebase-hosting-pull-request.yml
+++ b/.github/workflows/firebase-hosting-pull-request.yml
@@ -3,6 +3,12 @@
 
 name: Deploy to Firebase Hosting on PR
 
+permissions:
+  deployments: write
+  statuses: write
+  checks: write
+  pull-requests: write
+
 on:
   pull_request:
 
@@ -12,17 +18,25 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          submodules: true
+
+      - name: Setup Node
+        # yamllint disable-line rule:line-length
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: '24.18.0'
 
-      - name: Update and Build
+      - name: Build
         run: |
-          git submodule update --init
           cd website
-          npm install
+          npm ci
           npm run build
 
       - name: Firebase Hosting
-        uses: FirebaseExtended/action-hosting-deploy@v0
+        # yamllint disable-line rule:line-length
+        uses: FirebaseExtended/action-hosting-deploy@500ac625ca2dd40cbd15f7659af953801858032a # v0.11.0
         with:
           repoToken: '${{ secrets.GITHUB_TOKEN }}'
           firebaseServiceAccount: '${{ secrets.FIREBASE_SERVICE_ACCOUNT_GOLIOTH }}'