The pinned action versions had drifted apart between the container image repositories, which made it hard to tell whether a workflow failure was caused by a local change or by an outdated action. All actions are now pinned to the commit sha of their latest upstream release, so every repository runs the same toolchain.