diff --git a/.crystal-version b/.crystal-version
index 61ce01b..63e799c 100644
--- a/.crystal-version
+++ b/.crystal-version
@@ -1 +1 @@
-1.13.2
+1.14.1
diff --git a/.dockerignore b/.dockerignore
index 257efd6..a0a3705 100644
--- a/.dockerignore
+++ b/.dockerignore
@@ -1,3 +1,4 @@
+.git/
 docs/
 vendor/.cache/
 vendor/shards/install/
diff --git a/.github/workflows/acceptance.yml b/.github/workflows/acceptance.yml
index 87e6af8..a2b175e 100644
--- a/.github/workflows/acceptance.yml
+++ b/.github/workflows/acceptance.yml
@@ -17,13 +17,15 @@ jobs:
     steps:
       - name: checkout
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: fetch crystal version
         id: crystal-version
         run: echo "crystal=$(cat .crystal-version)" >> $GITHUB_OUTPUT
 
       - name: install crystal
-        uses: crystal-lang/install-crystal@v1.8.2
+        uses: crystal-lang/install-crystal@cdf26dcd488490c9939e9d4d62cab169c9e4f20d # pin@v1.8.2
         with:
           crystal: ${{ steps.crystal-version.outputs.crystal }}
 
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 9933a08..92b0f37 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -22,13 +22,15 @@ jobs:
     steps:
       - name: checkout
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: fetch crystal version
         id: crystal-version
         run: echo "crystal=$(cat .crystal-version)" >> $GITHUB_OUTPUT
 
       - name: install crystal
-        uses: crystal-lang/install-crystal@v1.8.2
+        uses: crystal-lang/install-crystal@cdf26dcd488490c9939e9d4d62cab169c9e4f20d # pin@v1.8.2
         with:
           crystal: ${{ steps.crystal-version.outputs.crystal }}
 
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 2cd6c7d..d99086b 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -46,6 +46,8 @@ jobs:
     steps:
       - name: checkout
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: extract image metadata
         id: meta
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index f0f6ec2..4a28783 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -20,13 +20,15 @@ jobs:
     steps:
       - name: checkout
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: fetch crystal version
         id: crystal-version
         run: echo "crystal=$(cat .crystal-version)" >> $GITHUB_OUTPUT
 
       - name: install crystal
-        uses: crystal-lang/install-crystal@v1.8.2
+        uses: crystal-lang/install-crystal@cdf26dcd488490c9939e9d4d62cab169c9e4f20d # pin@v1.8.2
         with:
           crystal: ${{ steps.crystal-version.outputs.crystal }}
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 01ed12c..f16e317 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -23,7 +23,7 @@ jobs:
         run: echo "crystal=$(cat .crystal-version)" >> $GITHUB_OUTPUT
 
       - name: install crystal
-        uses: crystal-lang/install-crystal@v1.8.2
+        uses: crystal-lang/install-crystal@cdf26dcd488490c9939e9d4d62cab169c9e4f20d # pin@v1.8.2
         with:
           crystal: ${{ steps.crystal-version.outputs.crystal }}
 
@@ -54,7 +54,7 @@ jobs:
           name: runway-binaries
           path: releases/
 
-      - uses: actions/create-github-app-token@v1.11.1
+      - uses: actions/create-github-app-token@c1a285145b9d317df6ced56c09f525b5c2b6f755 # pin@v1.11.1
         id: app-token
         with:
           app-id: ${{ vars.APP_ID }}
@@ -62,7 +62,7 @@ jobs:
 
       - name: Push a Release
         id: release
-        uses: ncipollo/release-action@v1.14.0
+        uses: ncipollo/release-action@cdcc88a9acf3ca41c16c37bb7d21b9ad48560d87 # pin@v1.15.0
         with:
           artifacts: "./releases/*"
           tag: ${{ env.VERSION }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 6d58ecb..15ababd 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -20,13 +20,15 @@ jobs:
     steps:
       - name: checkout
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: fetch crystal version
         id: crystal-version
         run: echo "crystal=$(cat .crystal-version)" >> $GITHUB_OUTPUT
 
       - name: install crystal
-        uses: crystal-lang/install-crystal@v1.8.2
+        uses: crystal-lang/install-crystal@cdf26dcd488490c9939e9d4d62cab169c9e4f20d # pin@v1.8.2
         with:
           crystal: ${{ steps.crystal-version.outputs.crystal }}
 
diff --git a/Dockerfile b/Dockerfile
index ed237aa..84f2f8f 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # https://github.com/84codes/crystal-container-images
-FROM 84codes/crystal:1.13.2-ubuntu-24.04 AS builder
+FROM 84codes/crystal:1.14.1-ubuntu-24.04 AS builder
 
 LABEL org.opencontainers.image.title="runway"
 LABEL org.opencontainers.image.description="clearing code for take off"
diff --git a/acceptance/logs/expected.log b/acceptance/logs/expected.log
index 5fe4212..a80ffa2 100644
--- a/acceptance/logs/expected.log
+++ b/acceptance/logs/expected.log
@@ -3,7 +3,7 @@ INFO: 📖 loading runway configuration
 DEBUG: attempting to load config from acceptance/config/config.yml
 INFO: ✅ loaded configuration successfully
 INFO: 🚚 2 projects loaded
-INFO: 🛫 starting runway - version: v0.2.3
+INFO: 🛫 starting runway - version: v0.2.4
 INFO: 📦 starting project project-1
 INFO: 🕐 scheduling event with interval 3s for project-1
 INFO: 📦 starting project project-2
diff --git a/shard.yml b/shard.yml
index 3a808e0..14c4eb1 100644
--- a/shard.yml
+++ b/shard.yml
@@ -1,5 +1,5 @@
 name: runway
-version: 0.2.3
+version: 0.2.4
 
 authors:
   - GrantBirki
@@ -8,7 +8,7 @@ targets:
   runway:
     main: src/cli.cr
 
-crystal: ">= 1.13.2"
+crystal: ">= 1.14.1"
 
 license: MIT
 
diff --git a/src/version.cr b/src/version.cr
index 11438b2..5b342ca 100644
--- a/src/version.cr
+++ b/src/version.cr
@@ -1,3 +1,3 @@
 module Runway
-  VERSION = "v0.2.3"
+  VERSION = "v0.2.4"
 end