diff --git a/.github/workflows/rspec.yml b/.github/workflows/rspec.yml
index e50a096e..6a08e913 100644
--- a/.github/workflows/rspec.yml
+++ b/.github/workflows/rspec.yml
@@ -13,9 +13,13 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   test:
-    runs-on: ubuntu-latest
+    # ubuntu-latest is now ubuntu-26.04, which has no prebuilt Ruby 3.0 or 3.1.
+    runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
       matrix:
diff --git a/.github/workflows/rubocop.yml b/.github/workflows/rubocop.yml
index 982bfd3b..896e593e 100644
--- a/.github/workflows/rubocop.yml
+++ b/.github/workflows/rubocop.yml
@@ -13,18 +13,22 @@ on:
   pull_request:
     branches: [ main ]
 
+permissions:
+  contents: read
+
 jobs:
   test:
-    runs-on: ubuntu-latest
+    # ubuntu-latest is now ubuntu-26.04, which has no prebuilt Ruby 3.0 or 3.1.
+    runs-on: ubuntu-24.04
     steps:
     - uses: actions/checkout@v2
     - name: Set up Ruby
     # To automatically get bug fixes and new Ruby versions for ruby/setup-ruby,
     # change this to (see https://github.com/ruby/setup-ruby#versioning):
     # uses: ruby/setup-ruby@v1
-      uses: ruby/setup-ruby@473e4d8fe5dd94ee328fdfca9f8c9c7afc9dae5e
+      uses: ruby/setup-ruby@e81a8fa391b11a595c1b7ed84177cc0fe02faf83 # v1.328.0
       with:
-        ruby-version: 3.0
+        ruby-version: '3.0'
         bundler-cache: true # runs 'bundle install' and caches installed gems automatically
     - name: Generate docs
       run: bundle exec rubocop --config .rubocop.yml
diff --git a/.github/workflows/sdk-reference.yaml b/.github/workflows/sdk-reference.yaml
index 71ce7169..97dd8a35 100644
--- a/.github/workflows/sdk-reference.yaml
+++ b/.github/workflows/sdk-reference.yaml
@@ -6,21 +6,25 @@ on:
       - main
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   docs:
-    runs-on: ubuntu-latest
+    # ubuntu-latest is now ubuntu-26.04, which has no prebuilt Ruby 3.0 or 3.1.
+    runs-on: ubuntu-24.04
     environment:
       name: sdk-reference
-      url: ${{ steps.deploy.outputs.url }}
+      url: ${{ steps.deploy.outputs.deployment-url }}
     steps:
       - uses: actions/checkout@v3
       - name: Set up Ruby
       # To automatically get bug fixes and new Ruby versions for ruby/setup-ruby,
       # change this to (see https://github.com/ruby/setup-ruby#versioning):
       # uses: ruby/setup-ruby@v1
-        uses: ruby/setup-ruby@473e4d8fe5dd94ee328fdfca9f8c9c7afc9dae5e
+        uses: ruby/setup-ruby@e81a8fa391b11a595c1b7ed84177cc0fe02faf83 # v1.328.0
         with:
-          ruby-version: 3.0
+          ruby-version: '3.0'
           bundler-cache: true # runs 'bundle install' and caches installed gems automatically
       - name: Generate documentation
         run: bundle exec yard
@@ -34,12 +38,10 @@ jobs:
               echo "CLOUDFLARE_BRANCH=$BRANCH" >> "$GITHUB_ENV"
           fi
       - name: Publish to Cloudflare Pages
-        uses: cloudflare/pages-action@v1
+        # cloudflare/pages-action no longer exists; wrangler-action is its replacement.
+        uses: cloudflare/wrangler-action@953926a2e2182532811c01a25e53647d93bf07c0 # v4.1.3
         id: deploy
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           accountId: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
-          projectName: nylas-ruby-sdk-reference
-          directory: doc
-          wranglerVersion: "3"
-          branch: ${{ env.CLOUDFLARE_BRANCH }}
+          command: pages deploy doc --project-name=nylas-ruby-sdk-reference --branch=${{ env.CLOUDFLARE_BRANCH }}