diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 57c5e5f..0100728 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,17 +15,16 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
 
       - name: Install wasm-pack
         run: |
-          curl -L https://github.com/rustwasm/wasm-pack/releases/download/v0.14.0/wasm-pack-v0.14.0-x86_64-unknown-linux-musl.tar.gz | tar xz
+          curl -L https://github.com/wasm-bindgen/wasm-pack/releases/download/v${{ vars.WASM_PACK_VERSION }}/wasm-pack-v${{ vars.WASM_PACK_VERSION }}-x86_64-unknown-linux-musl.tar.gz | tar xz
           sudo mv wasm-pack-*/wasm-pack /usr/local/bin/
 
       - name: Install wasm-bindgen-cli
         run: |
-          curl -L https://github.com/wasm-bindgen/wasm-bindgen/releases/download/0.2.118/wasm-bindgen-0.2.118-x86_64-unknown-linux-musl.tar.gz | tar xz
-          sudo mv wasm-bindgen-*/wasm-bindgen /usr/local/bin/
+          curl -L https://github.com/wasm-bindgen/wasm-bindgen/releases/download/${{ vars.WASM_BINDGEN_VERSION }}/wasm-bindgen-${{ vars.WASM_BINDGEN_VERSION }}-x86_64-unknown-linux-musl.tar.gz | tar xz
           sudo mv wasm-bindgen-*/wasm-bindgen-test-runner /usr/local/bin/
 
       - name: Rust tests
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 065ee86..401cb14 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -14,28 +14,28 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
 
       - name: Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e  # v6.4
         with:
           node-version: '24.15.0'
           registry-url: 'https://registry.npmjs.org'
 
       - name: Install wasm-pack
         run: |
-          curl -L https://github.com/wasm-bindgen/wasm-pack/releases/download/v0.14.0/wasm-pack-v0.14.0-x86_64-unknown-linux-musl.tar.gz | tar xz
+          curl -L https://github.com/wasm-bindgen/wasm-pack/releases/download/v${{ vars.WASM_PACK_VERSION }}/wasm-pack-v${{ vars.WASM_PACK_VERSION }}-x86_64-unknown-linux-musl.tar.gz | tar xz
           sudo mv wasm-pack-*/wasm-pack /usr/local/bin/
 
       - name: Install wasm-bindgen-cli
         run: |
-          curl -L https://github.com/wasm-bindgen/wasm-bindgen/releases/download/0.2.118/wasm-bindgen-0.2.118-x86_64-unknown-linux-musl.tar.gz | tar xz
+          curl -L https://github.com/wasm-bindgen/wasm-bindgen/releases/download/${{ vars.WASM_BINDGEN_VERSION }}/wasm-bindgen-${{ vars.WASM_BINDGEN_VERSION }}-x86_64-unknown-linux-musl.tar.gz | tar xz
           sudo mv wasm-bindgen-*/wasm-bindgen /usr/local/bin/
           sudo mv wasm-bindgen-*/wasm-bindgen-test-runner /usr/local/bin/
 
       - name: Install wasm-opt
         run: |
-          curl -L https://github.com/WebAssembly/binaryen/releases/download/version_129/binaryen-version_129-x86_64-linux.tar.gz | tar xz
+          curl -L https://github.com/WebAssembly/binaryen/releases/download/version_${{ vars.WASM_OPT_VERSION }}/binaryen-version_${{ vars.WASM_OPT_VERSION }}-x86_64-linux.tar.gz | tar xz
           sudo mv binaryen-*/bin/wasm-opt /usr/local/bin/
 
       - name: Rust tests