diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1e99a8a..dc84d11 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,6 +9,9 @@ on:
     branches:
       - "**"
 
+permissions:
+  contents: read
+
 jobs:
   test:
     runs-on: ubuntu-latest
@@ -26,10 +29,10 @@ jobs:
 
     steps:
       - name: Clone
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{ matrix.python }}
           architecture: x64
@@ -49,7 +52,7 @@ jobs:
         run: make test-all OPT="--dtype double"
 
       - name: Coverage
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6.0.0
         with:
           fail_ci_if_error: true
           files: ./coverage.xml
diff --git a/Makefile b/Makefile
index f17331a..8225cd6 100644
--- a/Makefile
+++ b/Makefile
@@ -23,13 +23,15 @@ TORCH_VERSION      := 2.3.1
 TORCHAUDIO_VERSION := 2.3.1
 PLATFORM           := cu121
 
+PIP_TIME_LIMIT := --uploaded-prior-to=$(shell date -u -d '14 days ago' '+%Y-%m-%dT%H:%M:%SZ')
+
 venv:
 	test -d .venv || python$(PYTHON_VERSION) -m venv .venv
 	. .venv/bin/activate && python -m pip install --upgrade pip
-	. .venv/bin/activate && python -m pip install --upgrade wheel
+	. .venv/bin/activate && python -m pip install --upgrade wheel $(PIP_TIME_LIMIT)
 	. .venv/bin/activate && python -m pip install torch==$(TORCH_VERSION)+$(PLATFORM) torchaudio==$(TORCHAUDIO_VERSION)+$(PLATFORM) \
 		--index-url https://download.pytorch.org/whl/$(PLATFORM)
-	. .venv/bin/activate && python -m pip install -e .[dev]
+	. .venv/bin/activate && python -m pip install -e .[dev] $(PIP_TIME_LIMIT)
 
 dist:
 	. .venv/bin/activate && python -m build
@@ -52,6 +54,7 @@ check: tool
 	. .venv/bin/activate && python -m mdformat --check *.md
 	.venv/bin/codespell
 	./tools/taplo/taplo fmt --check *.toml
+	./tools/pinact/pinact run --check .github/workflows/*.yml
 	./tools/yamlfmt/yamlfmt --lint *.cff *.yml .github/workflows/*.yml
 
 format: tool
@@ -59,6 +62,7 @@ format: tool
 	. .venv/bin/activate && python -m ruff format $(PROJECT) tests docs/source
 	. .venv/bin/activate && python -m mdformat *.md
 	./tools/taplo/taplo fmt *.toml
+	./tools/pinact/pinact run -u --min-age 14 .github/workflows/*.yml
 	./tools/yamlfmt/yamlfmt *.cff *.yml .github/workflows/*.yml
 
 test-all: test-example test
@@ -86,7 +90,7 @@ tool-clean:
 update: tool
 	. .venv/bin/activate && python -m pip install --upgrade pip
 	@./tools/taplo/taplo get -f pyproject.toml project.optional-dependencies.dev | while read -r package; do \
-		. .venv/bin/activate && python -m pip install --upgrade "$$package"; \
+		. .venv/bin/activate && python -m pip install --upgrade "$$package" $(PIP_TIME_LIMIT); \
 	done
 
 clean: dist-clean doc-clean test-clean tool-clean
diff --git a/tools/Makefile b/tools/Makefile
index beec1b7..5e39b05 100644
--- a/tools/Makefile
+++ b/tools/Makefile
@@ -14,15 +14,22 @@
 # limitations under the License.                                           #
 # ------------------------------------------------------------------------ #
 
+PINACT_VERSION  := 3.10.1
 TAPLO_VERSION   := 0.10.0
 YAMLFMT_VERSION := 0.21.0
 
-all: SPTK taplo yamlfmt
+all: SPTK pinact taplo yamlfmt
 
 SPTK:
 	git clone https://github.com/sp-nitech/SPTK.git
 	cd SPTK && make
 
+pinact:
+	mkdir -p pinact
+	wget https://github.com/suzuki-shunsuke/pinact/releases/download/v$(PINACT_VERSION)/pinact_linux_amd64.tar.gz -O pinact.tar.gz
+	tar xzf pinact.tar.gz -C pinact
+	rm -f pinact.tar.gz
+
 taplo:
 	mkdir -p taplo
 	wget https://github.com/tamasfe/taplo/releases/download/$(TAPLO_VERSION)/taplo-linux-x86_64.gz -O taplo.gz
@@ -37,6 +44,6 @@ yamlfmt:
 	rm -f yamlfmt.tar.gz
 
 clean:
-	rm -rf SPTK taplo yamlfmt
+	rm -rf SPTK pinact taplo yamlfmt
 
 .PHONY: all clean