diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 500951e18..1e662f367 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -15,6 +15,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@main
+      with:
+        persist-credentials: false
 
     - name: Install mdbook-dtmo
       run: |
@@ -33,10 +35,11 @@ jobs:
     - uses: actions/checkout@main
       with:
         fetch-depth: 2
+        persist-credentials: false
 
     - name: Get changed files
       id: changed-files
-      uses: tj-actions/changed-files@823fcebdb31bb35fdf2229d9f769b400309430d0 # v46.0.3
+      uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96  # v47.0.6
       with:
         files: |
           README.md
@@ -52,6 +55,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@main
+      with:
+        persist-credentials: false
 
     - name: Spell check
       env:
@@ -67,6 +72,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@main
+      with:
+        persist-credentials: false
 
     - name: Link check
       env:
@@ -82,6 +89,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@main
+      with:
+        persist-credentials: false
 
     - name: Prettier check
       env:
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 73245d29f..e8ab84c8f 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -11,7 +11,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@main
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     - name: Install mdbook-dtmo
       run: |
@@ -22,18 +24,24 @@ jobs:
       run: |
         mdbook-dtmo build .
 
-    - name: Install github-pages
-      run: |
-        npm install gh-pages@3.1.0
+    - name: Upload static files as artifact
+      id: deployment
+      uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+      with:
+        path: book
 
-    - name: Set Git config
-      run: |
-        git config user.email "no-one@mozilla.com"
-        git config user.name "GitHub Actions docs-deploy job"
-        git remote set-url origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/$GITHUB_REPOSITORY
+  deploy:
+    needs: build
+    permissions:
+      pages: write
+      id-token: write
 
-    - name: Deploy to GitHub pages
-      run: |
-        echo "docs-origin.telemetry.mozilla.org" > book/CNAME
-        npx gh-pages --dotfiles --message "Deploy docs" --dist book
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
 
+    runs-on: ubuntu-latest
+    steps:
+      - name: Deploy to GitHub Pages
+        id: deployment
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0