diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index fb9b2f62a..c68c81b46 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -23,27 +23,27 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-          language: [ 'java' ]
+        language: [ 'java' ]
     steps:
-    - name: Checkout repository
-      uses: actions/checkout@v3
-    - name: Set Swap Space
-      uses: pierotofy/set-swap-space@49819abfb41bd9b44fb781159c033dba90353a7c #v1.0
-      with:
+      - name: Checkout repository
+        uses: actions/checkout@755da8c3cf115ac066823e79a1e1788f8940201b # v3
+      - name: Set Swap Space
+        uses: pierotofy/set-swap-space@49819abfb41bd9b44fb781159c033dba90353a7c # v1.0
+        with:
           swap-size-gb: 10
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
-      with:
-        languages: ${{ matrix.language }}
-    - name: Set up JDK 
-      uses: actions/setup-java@v3
-      with:
-        distribution: "temurin"
-        java-version: 11
-    - name: Assemble
-      run: |
-        mkdir -p "$HOME/.gradle"
-        echo "org.gradle.jvmargs=-Xmx2g -XX:MaxMetaspaceSize=512m -XX:+HeapDumpOnOutOfMemoryError" > "$HOME/.gradle/gradle.properties"
-        ./gradlew assembleDebug
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@959cbb7472c4d4ad70cdfe6f4976053fe48ab394 # v2
+        with:
+          languages: ${{ matrix.language }}
+      - name: Set up JDK
+        uses: actions/setup-java@1df8dbefe2a8cbc99770194893dd902763bee34b # v3
+        with:
+          distribution: "temurin"
+          java-version: 11
+      - name: Assemble
+        run: |
+          mkdir -p "$HOME/.gradle"
+          echo "org.gradle.jvmargs=-Xmx2g -XX:MaxMetaspaceSize=512m -XX:+HeapDumpOnOutOfMemoryError" > "$HOME/.gradle/gradle.properties"
+          ./gradlew assembleDebug
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@959cbb7472c4d4ad70cdfe6f4976053fe48ab394 # v2
diff --git a/.github/workflows/detectNewJavaFiles.yml b/.github/workflows/detectNewJavaFiles.yml
index 7107619e4..b64964cef 100644
--- a/.github/workflows/detectNewJavaFiles.yml
+++ b/.github/workflows/detectNewJavaFiles.yml
@@ -1,3 +1,4 @@
+# synced from @nextcloud/android-config
 name: "Detect new java files"
 
 on:
@@ -10,23 +11,22 @@ jobs:
   detectNewJavaFiles:
     runs-on: ubuntu-latest
     steps:
-      -   id: file_changes
-          uses: trilom/file-changes-action@v1.2.4
-          with:
-            output: ','
-      -   name: Detect new java files
-          run: |
-            if [ -z '${{ steps.file_changes.outputs.files_added }}' ]; then
-                echo "No new files added"
-                exit 0
-            fi
-            new_java=$(echo '${{ steps.file_changes.outputs.files_added }}' | tr ',' '\n' | grep '\.java$' | cat)
-            if [ -n "$new_java" ]; then
-                # shellcheck disable=SC2016
-                printf 'New java files detected:\n```\n%s\n```\n' "$new_java" | tee "$GITHUB_STEP_SUMMARY"
-                exit 1
-            else
-                echo "No new java files detected"
-                exit 0
-            fi
-
+      - id: file_changes
+        uses: trilom/file-changes-action@a6ca26c14274c33b15e6499323aac178af06ad4b # v1.2.4
+        with:
+          output: ','
+      - name: Detect new java files
+        run: |
+          if [ -z '${{ steps.file_changes.outputs.files_added }}' ]; then
+              echo "No new files added"
+              exit 0
+          fi
+          new_java=$(echo '${{ steps.file_changes.outputs.files_added }}' | tr ',' '\n' | grep '\.java$' | cat)
+          if [ -n "$new_java" ]; then
+              # shellcheck disable=SC2016
+              printf 'New java files detected:\n```\n%s\n```\n' "$new_java" | tee "$GITHUB_STEP_SUMMARY"
+              exit 1
+          else
+              echo "No new java files detected"
+              exit 0
+          fi
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index e2124ec9f..09cb471f1 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -1,4 +1,4 @@
----
+# synced from @nextcloud/android-config
 name: 'Close stale issues'
 on:
   schedule:
@@ -14,7 +14,7 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/stale@v6
+      - uses: actions/stale@5ebf00ea0e4c1561e9b43a292ed34424fb1d4578 # v6
         with:
           days-before-stale: 28
           days-before-close: 14