diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index b683bc1..7ddf718 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -13,14 +13,17 @@ jobs:
     runs-on: macOS-latest
     strategy:
       matrix:
-        node-version: [12.13.0, 14.x, 16.x]
+        node-version: [16.x, 18.x, 20.x]
 
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v3
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/setup-node@60edb5dd545a775178f52524783378180af0d1f8 # v4.0.2
         with:
           node-version: ${{ matrix.node-version }}
           cache: yarn
+      - uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
+        with:
+          python-version: '3.11' # distutils is required by node-gyp and dropped by python core in 3.12
       - name: Install
         run: yarn --frozen-lockfile
       - name: Lint
@@ -28,7 +31,7 @@ jobs:
       - name: Test
         run: yarn coverage
       - name: Upload code coverage to Codecov
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@ab904c41d6ece82784817410c45d8b8c02684457 #v3.1.6
         with:
           file: ./coverage/lcov.info
           env_vars: NODE_VERSION
diff --git a/yarn.lock b/yarn.lock
index ae01ed9..160794e 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2003,9 +2003,9 @@ murmur-32@^0.1.0:
     imul "^1.0.0"
 
 nan@^2.4.0:
-  version "2.14.0"
-  resolved "https://registry.yarnpkg.com/nan/-/nan-2.14.0.tgz#7818f722027b2459a86f0295d434d1fc2336c52c"
-  integrity sha512-INOFj37C7k3AfaNTtX8RhsTw7qRy7eLET14cROi9+5HAVbbHuIWUHEauBv5qT4Av2tWasiTY1Jw6puUNqRJXQg==
+  version "2.20.0"
+  resolved "https://registry.yarnpkg.com/nan/-/nan-2.20.0.tgz#08c5ea813dd54ed16e5bd6505bf42af4f7838ca3"
+  integrity sha512-bk3gXBZDGILuuo/6sKtr0DQmSThYHLtNCdSdXk9YkxD/jK6X2vmCyyXBBxyqZ4XcnzTyYEAThfX3DCEnLf6igw==
 
 nanoid@3.3.1:
   version "3.3.1"