diff --git a/.github/workflows/autoApproveSync.yml b/.github/workflows/autoApproveSync.yml
new file mode 100644
index 000000000..e57fef386
--- /dev/null
+++ b/.github/workflows/autoApproveSync.yml
@@ -0,0 +1,18 @@
+name: Auto approve
+on:
+  pull_request_target:
+    branches:
+      - master
+      - main
+
+permissions:
+  pull-requests: write
+
+jobs:
+  auto-approve:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: hmarr/auto-approve-action@de8ae18c173c131e182d4adf2c874d8d2308a85b # v3.1.0
+        if: ${{ contains(github.event.pull_request.labels.*.name, 'sync') && github.actor == 'nextcloud-android-bot' }}
+        with:
+          github-token: "${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 51e507bfe..5343ca61e 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -32,11 +32,11 @@ jobs:
         with:
           swap-size-gb: 10
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@959cbb7472c4d4ad70cdfe6f4976053fe48ab394 # v2
+        uses: github/codeql-action/init@959cbb7472c4d4ad70cdfe6f4976053fe48ab394 # v2.1.37
         with:
           languages: ${{ matrix.language }}
       - name: Set up JDK
-        uses: actions/setup-java@1df8dbefe2a8cbc99770194893dd902763bee34b # v3
+        uses: actions/setup-java@1df8dbefe2a8cbc99770194893dd902763bee34b # v3.9.0
         with:
           distribution: "temurin"
           java-version: 11
@@ -46,4 +46,4 @@ jobs:
           echo "org.gradle.jvmargs=-Xmx2g -XX:MaxMetaspaceSize=512m -XX:+HeapDumpOnOutOfMemoryError" > "$HOME/.gradle/gradle.properties"
           ./gradlew assembleDebug
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@959cbb7472c4d4ad70cdfe6f4976053fe48ab394 # v2
+        uses: github/codeql-action/analyze@959cbb7472c4d4ad70cdfe6f4976053fe48ab394 # v2.1.37
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 6665c5739..a959af77b 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -22,5 +22,7 @@ jobs:
           only-labels: 'bug,needs info'
           exempt-issue-labels: 'no-stale'
           stale-issue-message: >-
-            This bug report did not receive an update in the last 4 weeks. Please take a look again and update the issue with new details, otherwise the issue will be automatically closed in 2 weeks. Thank you!
+            This bug report did not receive an update in the last 4 weeks.
+            Please take a look again and update the issue with new details,
+            otherwise the issue will be automatically closed in 2 weeks. Thank you!
           exempt-all-pr-milestones: true