diff --git a/.github/workflows/build_docs.yml b/.github/workflows/build_docs.yml
index c004920..a6d057d 100644
--- a/.github/workflows/build_docs.yml
+++ b/.github/workflows/build_docs.yml
@@ -46,7 +46,7 @@ jobs:
           path: napari
           fetch-depth: 0
       - name: Install the latest version of uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
         with:
           version: "latest"
           python-version: '3.12'
diff --git a/.github/workflows/edit_pr_description.yml b/.github/workflows/edit_pr_description.yml
index 7988c0c..0c7c2f2 100644
--- a/.github/workflows/edit_pr_description.yml
+++ b/.github/workflows/edit_pr_description.yml
@@ -20,7 +20,8 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          repository: napari/napari
+          repository: napari/shared-workflows
+          ref: main
       # install python and requests
       - name: Install the latest version of uv
         uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
diff --git a/.github/workflows/upload_coverage.yml b/.github/workflows/upload_coverage.yml
index 7309a9d..4831034 100644
--- a/.github/workflows/upload_coverage.yml
+++ b/.github/workflows/upload_coverage.yml
@@ -42,7 +42,7 @@ jobs:
         run: uv pip install coverage
 
       - name: Download coverage data
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: ${{ inputs.artifact-pattern }}
           path: covreports
@@ -73,7 +73,7 @@ jobs:
           python -Im coverage report --format=markdown --skip-empty --skip-covered >> $GITHUB_STEP_SUMMARY
 
       - name: Upload to codecov
-        uses: codecov/codecov-action@v6
+        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
         with:
           fail_ci_if_error: ${{ inputs.fail-on-coverage-error }}
           verbose: true