diff --git a/.github/workflows/draft-release.yml b/.github/workflows/draft-release.yml
index 986ed6d..7244e2d 100644
--- a/.github/workflows/draft-release.yml
+++ b/.github/workflows/draft-release.yml
@@ -19,11 +19,11 @@ jobs:
     name: 'Draft Release'
     runs-on: 'ubuntu-latest'
     steps:
-      - uses: 'actions/checkout@v3'
+      - uses: 'actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744' # ratchet:actions/checkout@v3
 
-      - uses: 'actions/setup-node@v3'
+      - uses: 'actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7' # ratchet:actions/setup-node@v3
         with:
-          node-version: '16.x'
+          node-version: '20.x'
 
       - name: 'Build and push'
         shell: 'bash'
@@ -48,7 +48,7 @@ jobs:
           git push origin $PR_BRANCH --force
 
       - name: 'Generate release notes'
-        uses: 'actions/github-script@v6'
+        uses: 'actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410' # ratchet:actions/github-script@v6
         with:
           script: |-
             let previousTagName = "";
@@ -89,7 +89,7 @@ jobs:
             }
 
       - name: 'Create Pull Request'
-        uses: 'actions/github-script@v6'
+        uses: 'actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410' # ratchet:actions/github-script@v6
         with:
           github-token: '${{ secrets.ACTIONS_BOT_TOKEN }}'
           script: |-
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a46a45d..2a8dba9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -8,14 +8,14 @@ jobs:
     name: 'Release'
     runs-on: 'ubuntu-latest'
     steps:
-      - uses: 'actions/checkout@v3'
+      - uses: 'actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744' # ratchet:actions/checkout@v3
 
       - name: 'Get package version'
         run: |-
           echo "NEW_VERSION=$(cat package.json | jq -r .version)" >> $GITHUB_ENV
 
       - name: 'Get previous release tag'
-        uses: 'actions/github-script@v6'
+        uses: 'actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410' # ratchet:actions/github-script@v6
         with:
           script: |-
             try {
@@ -33,10 +33,10 @@ jobs:
             }
 
       - name: 'Create release'
-        uses: 'actions/github-script@v6'
+        uses: 'actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410' # ratchet:actions/github-script@v6
         with:
-          script: |-
-            const tag = "v" + process.env.NEW_VERSION;
+          script: "const tag = \"v\" + process.env.NEW_VERSION;\n\ntry {\n  const createReleaseRequest = {\n    owner: context.repo.owner,\n    repo: context.repo.repo,\n    tag_name: tag,\n    target_commitish: context.sha,\n    name: tag,\n    generate_release_notes: true,\n  };\n\n  if (process.env.PREV_TAG) {\n    const releaseNotes = await github.rest.repos.generateReleaseNotes({\n      owner: context.repo.owner,\n      repo: context.repo.repo,\n      tag_name: tag,\n      target_commitish: context.sha,\n      previous_tag_name: process.env.PREV_TAG,\n    });\n    \n    createReleaseRequest.body = releaseNotes.data.body;\n    createReleaseRequest.generate_release_notes = false;\n  }\n\n  const response = await github.rest.repos.createRelease(createReleaseRequest);\n\n  core.info(\n    `Created release ${response.data.name} at ${response.data.html_url}`\n  );\n} catch (err) {\n  core.setFailed(`Failed to create release: ${err}`);\n}"
+        uses: 'actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410' # ratchet:actions/github-script@v6
 
             try {
               const createReleaseRequest = {