diff --git a/.github/workflows/pr-check-npm.yml b/.github/workflows/pr-check-npm.yml
index 8d308343e..437287a0b 100644
--- a/.github/workflows/pr-check-npm.yml
+++ b/.github/workflows/pr-check-npm.yml
@@ -26,7 +26,7 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.sha }}
-      - uses: actions/setup-node@v3.8.2
+      - uses: actions/setup-node@v3.8.1
         if: github.event_name != 'pull_request' || github.event.action != 'closed'
         with:
           cache: npm
@@ -52,7 +52,7 @@ jobs:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.sha }}
       - name: Set up Node.js
-        uses: actions/setup-node@v3.8.2
+        uses: actions/setup-node@v3.8.1
         if: github.event_name != 'pull_request' || github.event.action != 'closed'
         with:
           cache: npm
diff --git a/.github/workflows/pr-test.yml b/.github/workflows/pr-test.yml
index 7eedb46f7..ae2788b7b 100644
--- a/.github/workflows/pr-test.yml
+++ b/.github/workflows/pr-test.yml
@@ -24,7 +24,7 @@ jobs:
           DEST_PATH: "/home/runner/work/_temp/_github_workflow/.venv"
         run: bash "${GITHUB_WORKSPACE}/scripts/pr_test/pr_super_lint/install_pipenv.sh"
       - name: Set up Node.js
-        uses: actions/setup-node@v3.8.2
+        uses: actions/setup-node@v3.8.1
         with:
           cache: npm
       - name: Install dependencies
@@ -42,7 +42,7 @@ jobs:
   pr-dotenv-linter:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           submodules: "recursive"
           fetch-depth: 0
diff --git a/.github/workflows/pr-update-gitleaks.yml b/.github/workflows/pr-update-gitleaks.yml
index 765b0a264..bd296bf6a 100644
--- a/.github/workflows/pr-update-gitleaks.yml
+++ b/.github/workflows/pr-update-gitleaks.yml
@@ -22,7 +22,7 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.sha }}
-      - uses: actions/setup-node@v3.8.2
+      - uses: actions/setup-node@v3.8.1
         if: github.event_name != 'pull_request' || github.event.action != 'closed'
         with:
           cache: npm
diff --git a/renovate.json b/renovate.json
index ce0e09de5..dee312c44 100644
--- a/renovate.json
+++ b/renovate.json
@@ -3,6 +3,12 @@
     "github>dev-hato/renovate-config"
   ],
   "packageRules": [
+    {
+      "matchPackageNames": [
+        "flask"
+      ],
+      "allowedVersions": "<3.0.0"
+    },
     {
       "matchPackageNames": [
         "postgres"