diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 61a5d281..5ceac734 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -8,13 +8,13 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-latest, macOS-latest, windows-latest]
-        java: [11, 17, 20, 21-ea]
+        java: [11, 17, 21]
       fail-fast: false
       max-parallel: 4
     name: Test JDK ${{ matrix.java }}, ${{ matrix.os }}
 
     steps:
-      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
+      - uses: actions/checkout@v4
       - name: Set up JDK
         uses: actions/setup-java@v3
         with:
diff --git a/.github/workflows/codeql-analysis.yaml b/.github/workflows/codeql-analysis.yaml
index 05728370..ad3c924e 100644
--- a/.github/workflows/codeql-analysis.yaml
+++ b/.github/workflows/codeql-analysis.yaml
@@ -39,7 +39,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
+      uses: actions/checkout@v4
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
diff --git a/.github/workflows/coveralls.yaml b/.github/workflows/coveralls.yaml
index df8a1081..389b363f 100644
--- a/.github/workflows/coveralls.yaml
+++ b/.github/workflows/coveralls.yaml
@@ -7,7 +7,7 @@ jobs:
     if: github.repository_owner == 'spotbugs-OFF'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
+      - uses: actions/checkout@v4
       - name: Set up JDK
         uses: actions/setup-java@v3
         with:
diff --git a/.github/workflows/coverity.yaml b/.github/workflows/coverity.yaml
index b01d874d..9f6c9790 100644
--- a/.github/workflows/coverity.yaml
+++ b/.github/workflows/coverity.yaml
@@ -10,11 +10,11 @@ jobs:
     if: github.repository_owner == 'spotbugs'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
+      - uses: actions/checkout@v4
       - name: Set up JDK
         uses: actions/setup-java@v3
         with:
-          java-version: 17
+          java-version: 21
           distribution: 'zulu'
       - name: Analyze with Coverity
         run: |
diff --git a/.github/workflows/it-maven-3.3.9.yaml b/.github/workflows/it-maven-3.3.9.yaml
index d16feba0..75953f00 100644
--- a/.github/workflows/it-maven-3.3.9.yaml
+++ b/.github/workflows/it-maven-3.3.9.yaml
@@ -8,11 +8,11 @@ jobs:
     name: Integration Tests Maven 3.3.9
 
     steps:
-      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
+      - uses: actions/checkout@v4
       - name: Set up JDK
         uses: actions/setup-java@v3
         with:
-          java-version: 17
+          java-version: 21
           distribution: zulu
       - name: Load Maven 3.3.9
         run: ./mvnw -B -V org.apache.maven.plugins:maven-wrapper-plugin:3.2.0:wrapper -Dmaven=3.3.9 --no-transfer-progress
diff --git a/.github/workflows/it-maven-4.0.0.yaml b/.github/workflows/it-maven-4.0.0.yaml
index c98910e6..62aeaf7a 100644
--- a/.github/workflows/it-maven-4.0.0.yaml
+++ b/.github/workflows/it-maven-4.0.0.yaml
@@ -8,11 +8,11 @@ jobs:
     name: Integration Tests Maven 4.0.0-alpha-4
 
     steps:
-      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
+      - uses: actions/checkout@v4
       - name: Set up JDK
         uses: actions/setup-java@v3
         with:
-          java-version: 17
+          java-version: 21
           distribution: zulu
       - name: Load Maven 4.0.0-alpha-4
         run: ./mvnw -B -V org.apache.maven.plugins:maven-wrapper-plugin:3.2.0:wrapper -Dmaven=4.0.0-alpha-4 --no-transfer-progress
diff --git a/.github/workflows/it.yaml b/.github/workflows/it.yaml
index d6898d13..6de78174 100644
--- a/.github/workflows/it.yaml
+++ b/.github/workflows/it.yaml
@@ -8,11 +8,11 @@ jobs:
     name: Integration Tests
 
     steps:
-      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
+      - uses: actions/checkout@v4
       - name: Set up JDK
         uses: actions/setup-java@v3
         with:
-          java-version: 17
+          java-version: 21
           distribution: zulu
       - name: Build Setup
         run: ./mvnw -B -V clean install -Dlicense.skip=true --no-transfer-progress
diff --git a/.github/workflows/site.yaml b/.github/workflows/site.yaml
index ce7a7cad..edf837c6 100644
--- a/.github/workflows/site.yaml
+++ b/.github/workflows/site.yaml
@@ -10,11 +10,11 @@ jobs:
     if: github.repository_owner == 'spotbugs' && ! contains(toJSON(github.event.head_commit.message), '[maven-release-plugin]')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
+      - uses: actions/checkout@v4
       - name: Set up JDK
         uses: actions/setup-java@v3
         with:
-          java-version: 17
+          java-version: 21
           distribution: 'zulu'
       - uses: webfactory/ssh-agent@master
         with:
diff --git a/.github/workflows/sonar.yaml b/.github/workflows/sonar.yaml
index 86756a60..633aaa3c 100644
--- a/.github/workflows/sonar.yaml
+++ b/.github/workflows/sonar.yaml
@@ -10,14 +10,14 @@ jobs:
     if: github.repository_owner == 'spotbugs'
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
+      - uses: actions/checkout@v4
         with:
           # Disabling shallow clone is recommended for improving relevancy of reporting
           fetch-depth: 0
       - name: Set up JDK
         uses: actions/setup-java@v3
         with:
-          java-version: 17
+          java-version: 21
           distribution: zulu
       - name: Analyze with SonarCloud
         run: ./mvnw verify sonar:sonar -B -V -Dsonar.projectKey=spotbugs_spotbugs-maven-plugin -Dsonar.organization=spotbugs -Dsonar.host.url=https://sonarcloud.io -Dsonar.login=$SONAR_TOKEN -Dlicense.skip=true --no-transfer-progress
diff --git a/.github/workflows/sonatype.yaml b/.github/workflows/sonatype.yaml
index bf100111..32917f70 100644
--- a/.github/workflows/sonatype.yaml
+++ b/.github/workflows/sonatype.yaml
@@ -10,11 +10,11 @@ jobs:
     if: github.repository_owner == 'spotbugs' && ! contains(toJSON(github.event.head_commit.message), '[maven-release-plugin]')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
+      - uses: actions/checkout@v4
       - name: Set up JDK
         uses: actions/setup-java@v3
         with:
-          java-version: 17
+          java-version: 21
           distribution: 'zulu'
       - name: Deploy to Sonatype
         run: ./mvnw deploy -DskipTests -B -V --no-transfer-progress --settings ./.mvn/settings.xml -Dlicense.skip=true