diff --git a/.github/workflows/comment-pr.yml b/.github/workflows/comment-pr.yml
index 4aac84804a3..b005f0e8926 100644
--- a/.github/workflows/comment-pr.yml
+++ b/.github/workflows/comment-pr.yml
@@ -20,7 +20,7 @@ jobs:
       ACCESS_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
         with:
           ref: ${{github.event.workflow_run.head_branch}}
           repository: ${{github.event.workflow_run.head_repository.full_name}}
diff --git a/.github/workflows/pitest-update-pr.yml b/.github/workflows/pitest-update-pr.yml
index 6d5b181c40f..23ed927daf9 100644
--- a/.github/workflows/pitest-update-pr.yml
+++ b/.github/workflows/pitest-update-pr.yml
@@ -37,7 +37,7 @@ jobs:
           java-distribution: temurin
           maven-version: 3.9.9
       - name: Download Pitest analysis artifact
-        uses: dawidd6/action-download-artifact@09f2f74827fd3a8607589e5ad7f9398816f540fe # v3.1.4
+        uses: dawidd6/action-download-artifact@`09f2f74827fd3a8607589e5ad7f9398816f540fe # v3.1.4`
         with:
           workflow: ${{ github.event.workflow_run.workflow_id }}
           name: pitest-reports
diff --git a/.github/workflows/receive-pr.yml b/.github/workflows/receive-pr.yml
index 82bcdc2c0ac..fc6aac0f946 100644
--- a/.github/workflows/receive-pr.yml
+++ b/.github/workflows/receive-pr.yml
@@ -23,11 +23,12 @@ jobs:
         with:
           ref: ${{github.event.pull_request.head.ref}}
           repository: ${{github.event.pull_request.head.repo.full_name}}
-      - uses: actions/setup-java@v4
+      - name: Check out code and set up JDK and Maven
+        uses: s4u/setup-maven-action@489441643219d2b93ee2a127b2402eb640a1b947 # v1.13.0
         with:
-          java-version: '21'
-          distribution: 'temurin'
-          cache: 'maven'
+          java-version: ${{ matrix.jdk }}
+          java-distribution: ${{ matrix.distribution }}
+          maven-version: 3.9.9
 
       # Capture the PR number
       # https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#using-data-from-the-triggering-workflow