diff --git a/.github/workflows/release-package.yml b/.github/workflows/release-package.yml
index 5c1065c..e6be08f 100644
--- a/.github/workflows/release-package.yml
+++ b/.github/workflows/release-package.yml
@@ -10,42 +10,41 @@ permissions:
 
 jobs:
   publish:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     env:
       CCACHE_DIR: ${{ github.workspace }}/.ccache
       CCACHE_BASEDIR: ${{ github.workspace }}
       CCACHE_COMPILERCHECK: content
       CCACHE_NOHASHDIR: "true"
-      VOIGHT_FETCHCONTENT_BASE_DIR: ${{ github.workspace }}/native/parser/.cache/fetchcontent
+      EMSDK_REF: 41190c21c662e9cc1962aea94e71cbae9fd2fc87 # 5.0.7
+      EMSDK_VERSION: 5.0.7
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
         with:
           version: 10.23.0
           run_install: false
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: 24
           cache: pnpm
           registry-url: https://registry.npmjs.org
 
-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
         with:
           distribution: temurin
           java-version: "21"
 
-      - name: Restore native dependency cache
-        uses: actions/cache@v4
+      - name: Restore ANTLR tool cache
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
-          path: |
-            native/parser/.cache/fetchcontent
-            tools
-          key: ${{ runner.os }}-native-deps-${{ hashFiles('native/parser/CMakeLists.txt', 'native/parser/grammar/*.g4', 'tools/antlr-toolchain.env') }}
+          path: tools
+          key: ${{ runner.os }}-antlr-tools-${{ hashFiles('tools/antlr-toolchain.env') }}
 
       - name: Restore ccache
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: .ccache
           key: ${{ runner.os }}-ccache-release-${{ github.sha }}
@@ -55,9 +54,13 @@ jobs:
 
       - name: Install Emscripten SDK
         run: |
-          git clone --depth 1 https://github.com/emscripten-core/emsdk.git "$RUNNER_TEMP/emsdk"
-          "$RUNNER_TEMP/emsdk/emsdk" install latest
-          "$RUNNER_TEMP/emsdk/emsdk" activate latest
+          mkdir "$RUNNER_TEMP/emsdk"
+          git -C "$RUNNER_TEMP/emsdk" init
+          git -C "$RUNNER_TEMP/emsdk" remote add origin https://github.com/emscripten-core/emsdk.git
+          git -C "$RUNNER_TEMP/emsdk" fetch --depth 1 origin "$EMSDK_REF"
+          git -C "$RUNNER_TEMP/emsdk" checkout --detach "$EMSDK_REF"
+          "$RUNNER_TEMP/emsdk/emsdk" install "$EMSDK_VERSION"
+          "$RUNNER_TEMP/emsdk/emsdk" activate "$EMSDK_VERSION"
           echo "$RUNNER_TEMP/emsdk" >> "$GITHUB_PATH"
           echo "$RUNNER_TEMP/emsdk/upstream/emscripten" >> "$GITHUB_PATH"
 
diff --git a/.github/workflows/test-lint.yml b/.github/workflows/test-lint.yml
index 5601799..f69e4fd 100644
--- a/.github/workflows/test-lint.yml
+++ b/.github/workflows/test-lint.yml
@@ -18,7 +18,7 @@ permissions:
 
 jobs:
   test-lint:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     env:
       CCACHE_DIR: ${{ github.workspace }}/.ccache
       CCACHE_BASEDIR: ${{ github.workspace }}
@@ -27,25 +27,25 @@ jobs:
       VOIGHT_FETCHCONTENT_BASE_DIR: ${{ github.workspace }}/native/parser/.cache/fetchcontent
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
-      - uses: pnpm/action-setup@v5
+      - uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5
         with:
           version: 10.23.0
           run_install: false
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: 24
           cache: pnpm
 
-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
         with:
           distribution: temurin
           java-version: "21"
 
       - name: Restore native dependency cache
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: |
             native/parser/.cache/fetchcontent
@@ -53,7 +53,7 @@ jobs:
           key: ${{ runner.os }}-native-deps-${{ hashFiles('native/parser/CMakeLists.txt', 'native/parser/grammar/*.g4', 'tools/antlr-toolchain.env') }} 
 
       - name: Restore ccache
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: .ccache
           key: ${{ runner.os }}-ccache-${{ github.ref_name }}-${{ github.sha }}
@@ -62,10 +62,17 @@ jobs:
             ${{ runner.os }}-ccache-
 
       - name: Install Emscripten SDK
+        env:
+          EMSDK_REF: 41190c21c662e9cc1962aea94e71cbae9fd2fc87 # 5.0.7
+          EMSDK_VERSION: 5.0.7
         run: |
-          git clone --depth 1 https://github.com/emscripten-core/emsdk.git "$RUNNER_TEMP/emsdk"
-          "$RUNNER_TEMP/emsdk/emsdk" install latest
-          "$RUNNER_TEMP/emsdk/emsdk" activate latest
+          mkdir "$RUNNER_TEMP/emsdk"
+          git -C "$RUNNER_TEMP/emsdk" init
+          git -C "$RUNNER_TEMP/emsdk" remote add origin https://github.com/emscripten-core/emsdk.git
+          git -C "$RUNNER_TEMP/emsdk" fetch --depth 1 origin "$EMSDK_REF"
+          git -C "$RUNNER_TEMP/emsdk" checkout --detach "$EMSDK_REF"
+          "$RUNNER_TEMP/emsdk/emsdk" install "$EMSDK_VERSION"
+          "$RUNNER_TEMP/emsdk/emsdk" activate "$EMSDK_VERSION"
           echo "$RUNNER_TEMP/emsdk" >> "$GITHUB_PATH"
           echo "$RUNNER_TEMP/emsdk/upstream/emscripten" >> "$GITHUB_PATH"