diff --git a/.github/workflows/check-code-with-shellcheck.yml b/.github/workflows/check-code-with-shellcheck.yml
index 3db0e7438e..7aedf758a8 100644
--- a/.github/workflows/check-code-with-shellcheck.yml
+++ b/.github/workflows/check-code-with-shellcheck.yml
@@ -10,9 +10,9 @@ jobs:
     name: Github Actions
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
+    - uses: actions/checkout@v7.0.1
     - name: Run Shellcheck
-      uses: ludeeus/action-shellcheck@00b27aa7cb85167568cb48a3838b75f4265f2bca # master
+      uses: ludeeus/action-shellcheck@2.0.0
       with:
         check_together: 'yes'
       env:
diff --git a/.github/workflows/reviewdog.yml b/.github/workflows/reviewdog.yml
index 798fb65c36..7967e2fb55 100644
--- a/.github/workflows/reviewdog.yml
+++ b/.github/workflows/reviewdog.yml
@@ -11,9 +11,9 @@ jobs:
     name: Shellcheck testing
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
+      - uses: actions/checkout@v7.0.1
       - name: shellcheck
-        uses: reviewdog/action-shellcheck@0722bbdb0d47f04c1b53b8734d2422ac63a45ec6 # v1
+        uses: reviewdog/action-shellcheck@v1.32.1
         with:
           github_token: ${{ secrets.github_token }}
           reporter: github-pr-review
@@ -25,9 +25,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: spelling or typos
-        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6
+        uses: actions/checkout@v7.0.1
       - name: misspell
-        uses: reviewdog/action-misspell@d6429416b12b09b4e2768307d53bef58d172e962 # v1
+        # Version tag requested by maintainer instead of a pinned SHA.
+        uses: reviewdog/action-misspell@v1.28.0
         with:
           github_token: ${{ secrets.github_token }}
           locale: "US"
diff --git a/apps/eurooffice_docker.sh b/apps/eurooffice_docker.sh
index 2aa03e327d..8548e182b5 100644
--- a/apps/eurooffice_docker.sh
+++ b/apps/eurooffice_docker.sh
@@ -205,6 +205,8 @@ then
     Header set X-XSS-Protection "1; mode=block"
     Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
     Header set X-Content-Type-Options nosniff
+    # Only 'frame-ancestors' on purpose: EuroOffice documents no CSP for their Apache proxy
+    # example, and a self-invented one would just break the editor iframe inside Nextcloud.
     Header set Content-Security-Policy "frame-ancestors 'self' $NCDOMAIN"
 
     # contra mixed content warnings
diff --git a/not-supported/jellyfin.sh b/not-supported/jellyfin.sh
index 32b42a98b2..63f292c5a5 100644
--- a/not-supported/jellyfin.sh
+++ b/not-supported/jellyfin.sh
@@ -447,7 +447,9 @@ then
     Header set X-XSS-Protection "1; mode=block"
     Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
     Header set X-Content-Type-Options nosniff
-    Header set Content-Security-Policy "frame-ancestors 'self' $NCDOMAIN"
+    # Jellyfin sends no CSP itself and only publishes one in its nginx example (not the apache
+    # one), so we translate that policy to apache: https://jellyfin.org/docs/general/post-install/networking/reverse-proxy/nginx/
+    Header set Content-Security-Policy "default-src https: data: blob:; img-src 'self' https://* data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.gstatic.com https://www.youtube.com blob:; worker-src 'self' blob:; connect-src 'self'; object-src 'none'; font-src 'self'; frame-ancestors 'self'"
 
     # contra mixed content warnings
     RequestHeader set X-Forwarded-Proto "https"