diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3e8f8cf..35b7413 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -10,12 +10,12 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6.0.2
         with:
           persist-credentials: false
       - uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc  # v2.37.1, 2026-05-14
         with:
           php-version: '8.2'
-          tools: composer:v2
+          tools: composer:2.9.8
       - run: composer validate --strict
       - run: find lib -name "*.php" -print0 | xargs -0 -n1 php -l