diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index cd342e0..b4f878c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -36,11 +36,14 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@main
+        uses: actions/checkout@v4
 
       - name: Setup uv
         uses: astral-sh/setup-uv@v3
 
+      - name: Setup sops
+        run: brew install sops
+
       - name: Test
         run: task test --yes
 
@@ -63,7 +66,7 @@ jobs:
       contents: read
     steps:
       - name: Checkout
-        uses: actions/checkout@main
+        uses: actions/checkout@v4
 
       - name: Setup uv
         uses: astral-sh/setup-uv@v3
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 35ab16f..c58789a 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -43,6 +43,9 @@ jobs:
       - name: Setup uv
         uses: astral-sh/setup-uv@v3
 
+      - name: Setup sops
+        run: brew install sops
+
       - name: Build doc
         run: task gendoc --yes