diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 39d33b005d..ce8b0e72bd 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -30,12 +30,18 @@ jobs:
     env:
       DEPLOY_DIR: _site/
       DEPLOY_BRANCH: gh-pages
+      NODE_VERSION: 20.x
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           submodules: recursive
 
+      - name: Use Node.js ${{ env.NODE_VERSION }}
+        uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+
       - name: Prepare deployment branch
         run: |
           mkdir "${DEPLOY_DIR}"
diff --git a/eleventy.config.js b/eleventy.config.js
index 27412cea7c..81c5c442b9 100644
--- a/eleventy.config.js
+++ b/eleventy.config.js
@@ -155,7 +155,7 @@ export default function config(eleventyConfig) {
 
   eleventyConfig.addAsyncShortcode('attachment', async (ticketId, filename) => {
     const content = await fs.promises.readFile(
-      path.join(__dirname, `raw-attachment/ticket/${ticketId}`, filename)
+      path.resolve(`./raw-attachment/ticket/${ticketId}`, filename)
     )
     return content.toString()
   })