diff --git a/asdf-augmenters/.github/workflows/jekyll-gh-pages.yml b/asdf-augmenters/.github/workflows/jekyll-gh-pages.yml
index f4bd8e48b..4ce47046c 100644
--- a/asdf-augmenters/.github/workflows/jekyll-gh-pages.yml
+++ b/asdf-augmenters/.github/workflows/jekyll-gh-pages.yml
@@ -25,14 +25,14 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup Pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b  # v5
       - name: Build with Jekyll
-        uses: actions/jekyll-build-pages@v1
+        uses: actions/jekyll-build-pages@44a6e6beabd48582f863aeeb6cb2151cc1716697  # v1
         with:
           source: ./
           destination: ./_site
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v4
+        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b  # v4
   # Deployment job
   deploy:
     environment:
@@ -43,4 +43,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e  # v4
diff --git a/asdf-augmenters/.github/workflows/jekyll.yml b/asdf-augmenters/.github/workflows/jekyll.yml
index e9e649739..673988287 100644
--- a/asdf-augmenters/.github/workflows/jekyll.yml
+++ b/asdf-augmenters/.github/workflows/jekyll.yml
@@ -38,7 +38,7 @@ jobs:
           cache-version: 0 # Increment this number if you need to re-download cached gems
       - name: Setup Pages
         id: pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b  # v5
       - name: Build with Jekyll
         # Outputs to the './_site' directory by default
         run: bundle exec jekyll build --baseurl "${{ steps.pages.outputs.base_path }}"
@@ -46,7 +46,7 @@ jobs:
           JEKYLL_ENV: production
       - name: Upload artifact
         # Automatically uploads an artifact from the './_site' directory by default
-        uses: actions/upload-pages-artifact@v4
+        uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b  # v4
   # Deployment job
   deploy:
     environment:
@@ -57,4 +57,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e  # v4
diff --git a/asdf-augmenters/asdf-acceleration-middleware/.github/workflows/ci.yml b/asdf-augmenters/asdf-acceleration-middleware/.github/workflows/ci.yml
index 09fd9939f..82ac6a08d 100644
--- a/asdf-augmenters/asdf-acceleration-middleware/.github/workflows/ci.yml
+++ b/asdf-augmenters/asdf-acceleration-middleware/.github/workflows/ci.yml
@@ -14,15 +14,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87  # stable
+        with:
+          toolchain: stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2
       - run: cargo check --all
   fmt:
     name: Format
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87  # stable
         with:
           components: rustfmt
       - run: cargo fmt --all -- --check
@@ -31,10 +33,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87  # stable
         with:
           components: clippy
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2
       - run: cargo clippy --all -- -D warnings
   test:
     name: Test
@@ -45,26 +47,26 @@ jobs:
         rust: [stable, beta]
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: dtolnay/rust-toolchain@master
+      - uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de  # master
         with:
           toolchain: ${{ matrix.rust }}
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2
       - run: cargo test --all
   bench:
     name: Benchmark
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87  # stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2
       - run: cargo bench --all
   security:
     name: Security Audit
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87  # stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2
       - run: cargo install cargo-audit
       - run: cargo audit
   coverage:
@@ -72,11 +74,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87  # stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2
       - run: cargo install cargo-tarpaulin
       - run: cargo tarpaulin --all --out Xml
-      - uses: codecov/codecov-action@v3
+      - uses: codecov/codecov-action@ab904c41d6ece82784817410c45d8b8c02684457  # v3
         with:
           files: ./cobertura.xml
   rsr-compliance:
@@ -84,8 +86,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87  # stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2
       - run: cargo install just
       - run: just rsr-verify
   docs:
@@ -93,10 +95,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: Swatinem/rust-cache@v2
+      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87  # stable
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2
       - run: cargo doc --all --no-deps
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5  # v3
         with:
           name: documentation
           path: target/doc/
diff --git a/asdf-augmenters/asdf-acceleration-middleware/.github/workflows/jekyll-gh-pages.yml b/asdf-augmenters/asdf-acceleration-middleware/.github/workflows/jekyll-gh-pages.yml
index 24a19d78d..093213646 100644
--- a/asdf-augmenters/asdf-acceleration-middleware/.github/workflows/jekyll-gh-pages.yml
+++ b/asdf-augmenters/asdf-acceleration-middleware/.github/workflows/jekyll-gh-pages.yml
@@ -25,14 +25,14 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup Pages
-        uses: actions/configure-pages@v5
+        uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b  # v5
       - name: Build with Jekyll
-        uses: actions/jekyll-build-pages@v1
+        uses: actions/jekyll-build-pages@44a6e6beabd48582f863aeeb6cb2151cc1716697  # v1
         with:
           source: ./
           destination: ./_site
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa  # v3
   # Deployment job
   deploy:
     environment:
@@ -43,4 +43,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e  # v4
diff --git a/asdf-augmenters/asdf-acceleration-middleware/.github/workflows/release.yml b/asdf-augmenters/asdf-acceleration-middleware/.github/workflows/release.yml
index 5a289c515..e12aa9686 100644
--- a/asdf-augmenters/asdf-acceleration-middleware/.github/workflows/release.yml
+++ b/asdf-augmenters/asdf-acceleration-middleware/.github/workflows/release.yml
@@ -33,10 +33,11 @@ jobs:
             use-cross: false
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87  # stable
         with:
+          toolchain: stable
           targets: ${{ matrix.target }}
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2
       - name: Install cross
         if: matrix.use-cross
         run: cargo install cross
@@ -65,7 +66,7 @@ jobs:
             tar -czf release/asdf-acceleration-middleware-${{ matrix.target }}.tar.gz -C release .
           fi
         shell: bash
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5  # v3
         with:
           name: ${{ matrix.target }}
           path: release/*
@@ -75,11 +76,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: actions/download-artifact@v3
+      - uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a  # v3
         with:
           path: artifacts
       - name: Create Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844  # v1
         with:
           files: artifacts/**/*
           generate_release_notes: true
@@ -91,5 +92,5 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87  # stable
       - run: cargo publish --token ${{ secrets.CARGO_TOKEN }}
diff --git a/asdf-augmenters/asdf-acceleration-middleware/.github/workflows/rust-ci.yml b/asdf-augmenters/asdf-acceleration-middleware/.github/workflows/rust-ci.yml
index ad0a1fa92..d0ec8306b 100644
--- a/asdf-augmenters/asdf-acceleration-middleware/.github/workflows/rust-ci.yml
+++ b/asdf-augmenters/asdf-acceleration-middleware/.github/workflows/rust-ci.yml
@@ -9,10 +9,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87  # stable
         with:
+          toolchain: stable
           components: rustfmt, clippy
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6  # v2
       - name: Check formatting
         run: cargo fmt --all -- --check
       - name: Clippy lints
@@ -25,7 +26,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87  # stable
       - name: Install cargo-audit
         run: cargo install cargo-audit
       - name: Security audit
@@ -36,11 +37,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87  # stable
       - name: Install tarpaulin
         run: cargo install cargo-tarpaulin
       - name: Generate coverage
         run: cargo tarpaulin --out Xml
-      - uses: codecov/codecov-action@v3
+      - uses: codecov/codecov-action@ab904c41d6ece82784817410c45d8b8c02684457  # v3
         with:
           files: cobertura.xml
diff --git a/bridge-nginx-zig/.github/workflows/security-checks.yml b/bridge-nginx-zig/.github/workflows/security-checks.yml
index b6d07b1b4..b50d9a66e 100644
--- a/bridge-nginx-zig/.github/workflows/security-checks.yml
+++ b/bridge-nginx-zig/.github/workflows/security-checks.yml
@@ -100,10 +100,10 @@ jobs:
   trufflehog:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
         with:
           fetch-depth: 0
       - name: TruffleHog Secret Scan
-        uses: trufflesecurity/trufflehog@main
+        uses: trufflesecurity/trufflehog@288a8a8643a2c5a36b81d231c550dccfa0beeb64  # main
         with:
           extra_args: --only-verified --fail
diff --git a/coq-ecosystem/coq-jr/.github/workflows/security-checks.yml b/coq-ecosystem/coq-jr/.github/workflows/security-checks.yml
index b6d07b1b4..b50d9a66e 100644
--- a/coq-ecosystem/coq-jr/.github/workflows/security-checks.yml
+++ b/coq-ecosystem/coq-jr/.github/workflows/security-checks.yml
@@ -100,10 +100,10 @@ jobs:
   trufflehog:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
         with:
           fetch-depth: 0
       - name: TruffleHog Secret Scan
-        uses: trufflesecurity/trufflehog@main
+        uses: trufflesecurity/trufflehog@288a8a8643a2c5a36b81d231c550dccfa0beeb64  # main
         with:
           extra_args: --only-verified --fail
diff --git a/czech-file-knife/.github/workflows/stress-test.yml b/czech-file-knife/.github/workflows/stress-test.yml
index 90d91d11f..028860ff8 100644
--- a/czech-file-knife/.github/workflows/stress-test.yml
+++ b/czech-file-knife/.github/workflows/stress-test.yml
@@ -12,7 +12,9 @@ jobs:
     steps:
       - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87  # stable
+        with:
+          toolchain: stable
       - name: Install stress testing tools
         run: |
           sudo apt-get update
diff --git a/dnfinition/.github/workflows/integration-tests.yml b/dnfinition/.github/workflows/integration-tests.yml
index 7996622c9..0e0d1847c 100644
--- a/dnfinition/.github/workflows/integration-tests.yml
+++ b/dnfinition/.github/workflows/integration-tests.yml
@@ -14,7 +14,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
       - name: Setup Alire
-        uses: alire-project/setup-alire@v3
+        uses: alire-project/setup-alire@b607671067a8ca5d7b7f4a12dadb4dc009cd2cc7  # v3
         with:
           toolchain: gnat_native^14 gprbuild^22
       - name: Build project
@@ -36,7 +36,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
       - name: Setup Elixir
-        uses: erlef/setup-beam@v1
+        uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124  # v1
         with:
           elixir-version: '1.16'
           otp-version: '26'
@@ -57,11 +57,11 @@ jobs:
       - name: Checkout
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
       - name: Setup Alire
-        uses: alire-project/setup-alire@v3
+        uses: alire-project/setup-alire@b607671067a8ca5d7b7f4a12dadb4dc009cd2cc7  # v3
         with:
           toolchain: gnat_native^14 gprbuild^22
       - name: Setup Elixir
-        uses: erlef/setup-beam@v1
+        uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124  # v1
         with:
           elixir-version: '1.16'
           otp-version: '26'
diff --git a/dnfinition/.github/workflows/spark-proofs.yml b/dnfinition/.github/workflows/spark-proofs.yml
index 789145a57..4217decc9 100644
--- a/dnfinition/.github/workflows/spark-proofs.yml
+++ b/dnfinition/.github/workflows/spark-proofs.yml
@@ -20,7 +20,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
       - name: Setup Alire
-        uses: alire-project/setup-alire@v3
+        uses: alire-project/setup-alire@b607671067a8ca5d7b7f4a12dadb4dc009cd2cc7  # v3
         with:
           toolchain: gnat_native^14 gprbuild^22
       - name: Install SPARK
diff --git a/idris2-ecosystem/echidna/.github/workflows/test-and-benchmark.yml b/idris2-ecosystem/echidna/.github/workflows/test-and-benchmark.yml
index 363ef4da5..0ff2f3cae 100644
--- a/idris2-ecosystem/echidna/.github/workflows/test-and-benchmark.yml
+++ b/idris2-ecosystem/echidna/.github/workflows/test-and-benchmark.yml
@@ -62,7 +62,7 @@ jobs:
           mkdir -p benchmark-results
           idris2 --exec bench/VocabularyBench.idr > benchmark-results/$(date +%Y%m%d-%H%M%S).txt
       - name: Upload benchmark results
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5  # v3
         with:
           name: benchmark-results
           path: /var/mnt/eclipse/repos/developer-ecosystem/idris2-ecosystem/echidna/benchmark-results/
@@ -74,7 +74,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Download benchmark results
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a  # v3
         with:
           name: benchmark-results
       - name: Analyze regression
diff --git a/iser-tools/nimiser/.github/workflows/k9-svc-validation.yml b/iser-tools/nimiser/.github/workflows/k9-svc-validation.yml
index f8dc053fc..f1a12914f 100644
--- a/iser-tools/nimiser/.github/workflows/k9-svc-validation.yml
+++ b/iser-tools/nimiser/.github/workflows/k9-svc-validation.yml
@@ -4,7 +4,7 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
       - name: Validate contractiles
         run: |
           #!/bin/bash
diff --git a/iser-tools/otpiser/.github/workflows/k9-svc-validation.yml b/iser-tools/otpiser/.github/workflows/k9-svc-validation.yml
index f8dc053fc..f1a12914f 100644
--- a/iser-tools/otpiser/.github/workflows/k9-svc-validation.yml
+++ b/iser-tools/otpiser/.github/workflows/k9-svc-validation.yml
@@ -4,7 +4,7 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
       - name: Validate contractiles
         run: |
           #!/bin/bash
diff --git a/packages/.github/workflows/testpr.yml b/packages/.github/workflows/testpr.yml
index 2d7a8ca9b..16d70fab9 100644
--- a/packages/.github/workflows/testpr.yml
+++ b/packages/.github/workflows/testpr.yml
@@ -8,7 +8,7 @@ jobs:
         with:
           fetch-depth: 0
           ref: ${{ github.event.pull_request.head.sha }}
-      - uses: iffy/install-nim@v5.1.1
+      - uses: iffy/install-nim@cceb6b4d10dcb1968575ac083d4981c0302fd00d  # v5.1.1
         with:
           version: stable
       - run: ./getmergebase.sh
diff --git a/packages/.github/workflows/testpush.yml b/packages/.github/workflows/testpush.yml
index d1e9bfd5e..59584a38e 100644
--- a/packages/.github/workflows/testpush.yml
+++ b/packages/.github/workflows/testpush.yml
@@ -5,7 +5,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: iffy/install-nim@v5.1.1
+      - uses: iffy/install-nim@cceb6b4d10dcb1968575ac083d4981c0302fd00d  # v5.1.1
         with:
           version: stable
       - run: nim c -d:ssl -r -d:release package_scanner.nim packages.json
diff --git a/rescript-ecosystem/idaptik-rescript13-staging/.github/workflows/dogfood-gate.yml b/rescript-ecosystem/idaptik-rescript13-staging/.github/workflows/dogfood-gate.yml
index 06098645d..a0d00c973 100644
--- a/rescript-ecosystem/idaptik-rescript13-staging/.github/workflows/dogfood-gate.yml
+++ b/rescript-ecosystem/idaptik-rescript13-staging/.github/workflows/dogfood-gate.yml
@@ -32,7 +32,7 @@ jobs:
           fi
       - name: Validate A2ML manifests
         if: steps.detect.outputs.count > 0
-        uses: hyperpolymath/a2ml-validate-action@main
+        uses: hyperpolymath/a2ml-validate-action@57db3145f76993d3bc0f2fb80f499cead06e6bc3  # main
         with:
           path: '.'
           strict: 'false'
diff --git a/rescript-ecosystem/packages/core/compiler-source/.github/workflows/ci.yml b/rescript-ecosystem/packages/core/compiler-source/.github/workflows/ci.yml
index d9371b66c..90c3fab1d 100644
--- a/rescript-ecosystem/packages/core/compiler-source/.github/workflows/ci.yml
+++ b/rescript-ecosystem/packages/core/compiler-source/.github/workflows/ci.yml
@@ -83,7 +83,7 @@ jobs:
         run: yarn install
       - name: Install dependencies (Linux)
         if: runner.os == 'Linux'
-        uses: awalsh128/cache-apt-pkgs-action@v1.4.3
+        uses: awalsh128/cache-apt-pkgs-action@5902b33ae29014e6ca012c5d8025d4346556bd40  # v1.4.3
         with:
           # https://github.com/ocaml/setup-ocaml/blob/2f57267f071bc8547dfcb9433ff21d44fffef190/packages/setup-ocaml/src/unix.ts#L48
           # plus OPAM wants cmake
@@ -107,7 +107,9 @@ jobs:
           echo "version=${version}" >> "$GITHUB_OUTPUT"
       - name: Install rust toolchain
         if: steps.rewatch-build-cache.outputs.cache-hit != 'true'
-        uses: dtolnay/rust-toolchain@master
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de  # master
+        with:
+          toolchain: master
         with:
           toolchain: ${{ steps.rust-version.outputs.version }}
           targets: ${{ matrix.rust-target }}
@@ -137,7 +139,7 @@ jobs:
         run: echo "opam_cache_key=opam-env-v8-${{ matrix.os }}-${{ env.SETUP_OCAML_VERSION }}-${{ matrix.ocaml_compiler }}-${{ hashFiles('*.opam') }}" | sed 's/,/-/g' >> $GITHUB_ENV
       - name: Restore OPAM environment
         id: cache-opam-env
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25  # v5
         with:
           path: |-
             ${{ runner.tool_cache }}/opam
diff --git a/rescript-ecosystem/packages/core/compiler-source/.github/workflows/stale.yml b/rescript-ecosystem/packages/core/compiler-source/.github/workflows/stale.yml
index bff566d7b..624fff46f 100644
--- a/rescript-ecosystem/packages/core/compiler-source/.github/workflows/stale.yml
+++ b/rescript-ecosystem/packages/core/compiler-source/.github/workflows/stale.yml
@@ -10,7 +10,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v10
+      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629  # v10
         with:
           stale-issue-message: 'This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.'
           stale-issue-label: stale
diff --git a/rescript-ecosystem/packages/ffi/wasm-runtime/.github/workflows/quality.yml b/rescript-ecosystem/packages/ffi/wasm-runtime/.github/workflows/quality.yml
index 16bdf1b4e..b611cff87 100644
--- a/rescript-ecosystem/packages/ffi/wasm-runtime/.github/workflows/quality.yml
+++ b/rescript-ecosystem/packages/ffi/wasm-runtime/.github/workflows/quality.yml
@@ -10,7 +10,7 @@ jobs:
         run: |
           find . -type f -perm /111 -name "*.sh" | head -10 || true
       - name: Check for secrets
-        uses: trufflesecurity/trufflehog@main
+        uses: trufflesecurity/trufflehog@288a8a8643a2c5a36b81d231c550dccfa0beeb64  # main
         with:
           path: ./
           base: ${{ github.event.pull_request.base.sha || github.event.before }}
@@ -24,7 +24,7 @@ jobs:
         run: |
           find . -type f -size +1M -not -path "./.git/*" | head -10 || echo "No large files"
       - name: EditorConfig check
-        uses: editorconfig-checker/action-editorconfig-checker@main
+        uses: editorconfig-checker/action-editorconfig-checker@e53d2fe21373eecafe8f11fc92b7f25d244cc94c  # main
         continue-on-error: true
   docs:
     runs-on: ubuntu-latest
diff --git a/rescript-ecosystem/packages/ffi/wasm-runtime/.github/workflows/rescript-deno-ci.yml b/rescript-ecosystem/packages/ffi/wasm-runtime/.github/workflows/rescript-deno-ci.yml
index bc253ceae..055120e26 100644
--- a/rescript-ecosystem/packages/ffi/wasm-runtime/.github/workflows/rescript-deno-ci.yml
+++ b/rescript-ecosystem/packages/ffi/wasm-runtime/.github/workflows/rescript-deno-ci.yml
@@ -6,7 +6,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-      - uses: denoland/setup-deno@v1
+      - uses: denoland/setup-deno@11b63cf76cfcafb4e43f97b6cad24d8e8438f62d  # v1
         with:
           deno-version: v1.x
       - name: Deno lint
@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-      - uses: denoland/setup-deno@v1
+      - uses: denoland/setup-deno@11b63cf76cfcafb4e43f97b6cad24d8e8438f62d  # v1
       - name: Check permissions
         run: |
           # Audit for dangerous permissions
diff --git a/rescript-ecosystem/packages/tooling/evangeliser/.github/workflows/ci.yml b/rescript-ecosystem/packages/tooling/evangeliser/.github/workflows/ci.yml
index b1589f6a9..bfbbd588c 100644
--- a/rescript-ecosystem/packages/tooling/evangeliser/.github/workflows/ci.yml
+++ b/rescript-ecosystem/packages/tooling/evangeliser/.github/workflows/ci.yml
@@ -52,7 +52,7 @@ jobs:
           npm run test:coverage
       - name: Upload coverage to Codecov
         if: matrix.os == 'ubuntu-latest'
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@ab904c41d6ece82784817410c45d8b8c02684457  # v3
         with:
           files: ./extension/coverage/lcov.info
           flags: unittests
@@ -203,7 +203,7 @@ jobs:
           cd extension
           npx vsce package
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844  # v1
         with:
           files: extension/*.vsix
           generate_release_notes: true
diff --git a/rescript-ecosystem/packages/tooling/evangeliser/.github/workflows/npm-bun-blocker.yml b/rescript-ecosystem/packages/tooling/evangeliser/.github/workflows/npm-bun-blocker.yml
index bbe0bb67d..74ddb2cff 100644
--- a/rescript-ecosystem/packages/tooling/evangeliser/.github/workflows/npm-bun-blocker.yml
+++ b/rescript-ecosystem/packages/tooling/evangeliser/.github/workflows/npm-bun-blocker.yml
@@ -25,7 +25,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v7.0.1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - name: Block npm/pnpm/yarn lockfiles
         run: |
           # Bun is tier 1 (owner ruling 2026-08-26): package.json + bun.lock are
diff --git a/rescript-ecosystem/packages/tooling/evangeliser/.github/workflows/quality.yml b/rescript-ecosystem/packages/tooling/evangeliser/.github/workflows/quality.yml
index 16bdf1b4e..b611cff87 100644
--- a/rescript-ecosystem/packages/tooling/evangeliser/.github/workflows/quality.yml
+++ b/rescript-ecosystem/packages/tooling/evangeliser/.github/workflows/quality.yml
@@ -10,7 +10,7 @@ jobs:
         run: |
           find . -type f -perm /111 -name "*.sh" | head -10 || true
       - name: Check for secrets
-        uses: trufflesecurity/trufflehog@main
+        uses: trufflesecurity/trufflehog@288a8a8643a2c5a36b81d231c550dccfa0beeb64  # main
         with:
           path: ./
           base: ${{ github.event.pull_request.base.sha || github.event.before }}
@@ -24,7 +24,7 @@ jobs:
         run: |
           find . -type f -size +1M -not -path "./.git/*" | head -10 || echo "No large files"
       - name: EditorConfig check
-        uses: editorconfig-checker/action-editorconfig-checker@main
+        uses: editorconfig-checker/action-editorconfig-checker@e53d2fe21373eecafe8f11fc92b7f25d244cc94c  # main
         continue-on-error: true
   docs:
     runs-on: ubuntu-latest
diff --git a/rescript-ecosystem/packages/web/bridge-web/.github/workflows/security-checks.yml b/rescript-ecosystem/packages/web/bridge-web/.github/workflows/security-checks.yml
index b6d07b1b4..b50d9a66e 100644
--- a/rescript-ecosystem/packages/web/bridge-web/.github/workflows/security-checks.yml
+++ b/rescript-ecosystem/packages/web/bridge-web/.github/workflows/security-checks.yml
@@ -100,10 +100,10 @@ jobs:
   trufflehog:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
         with:
           fetch-depth: 0
       - name: TruffleHog Secret Scan
-        uses: trufflesecurity/trufflehog@main
+        uses: trufflesecurity/trufflehog@288a8a8643a2c5a36b81d231c550dccfa0beeb64  # main
         with:
           extra_args: --only-verified --fail
diff --git a/rescript-ecosystem/rescript-evangeliser/.github/workflows/ci.yml b/rescript-ecosystem/rescript-evangeliser/.github/workflows/ci.yml
index d27411c8e..a295dc533 100644
--- a/rescript-ecosystem/rescript-evangeliser/.github/workflows/ci.yml
+++ b/rescript-ecosystem/rescript-evangeliser/.github/workflows/ci.yml
@@ -141,7 +141,7 @@ jobs:
           cd extension
           npx vsce package
       - name: Upload VSIX artifact
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@ff15f0306b3f739f7b6fd43fb5d26cd321bd4de5  # v3
         with:
           name: nextgen-languages-evangeliser-vsix
           path: extension/*.vsix
@@ -205,7 +205,7 @@ jobs:
           cd extension
           npx vsce package
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844  # v1
         with:
           files: extension/*.vsix
           generate_release_notes: true
diff --git a/rescript-ecosystem/rescript-evangeliser/.github/workflows/quality.yml b/rescript-ecosystem/rescript-evangeliser/.github/workflows/quality.yml
index 5380ce86c..8ddf84c92 100644
--- a/rescript-ecosystem/rescript-evangeliser/.github/workflows/quality.yml
+++ b/rescript-ecosystem/rescript-evangeliser/.github/workflows/quality.yml
@@ -10,7 +10,7 @@ jobs:
         run: |
           find . -type f -perm /111 -name "*.sh" | head -10 || true
       - name: Check for secrets
-        uses: trufflesecurity/trufflehog@main
+        uses: trufflesecurity/trufflehog@288a8a8643a2c5a36b81d231c550dccfa0beeb64  # main
         with:
           path: ./
           base: ${{ github.event.pull_request.base.sha || github.event.before }}
@@ -24,7 +24,7 @@ jobs:
         run: |
           find . -type f -size +1M -not -path "./.git/*" | head -10 || echo "No large files"
       - name: EditorConfig check
-        uses: editorconfig-checker/action-editorconfig-checker@main
+        uses: editorconfig-checker/action-editorconfig-checker@e53d2fe21373eecafe8f11fc92b7f25d244cc94c  # main
         continue-on-error: true
   docs:
     runs-on: ubuntu-latest
diff --git a/rescript-ecosystem/rescript-tea/.github/workflows/e2e.yml b/rescript-ecosystem/rescript-tea/.github/workflows/e2e.yml
index 1ac193f86..e3d6d531d 100644
--- a/rescript-ecosystem/rescript-tea/.github/workflows/e2e.yml
+++ b/rescript-ecosystem/rescript-tea/.github/workflows/e2e.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-      - uses: denoland/setup-deno@v2
+      - uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed  # v2
         with: {deno-version: v2.x}
       - name: Run E2E tests
         run: deno run --allow-all tests/e2e_test.js
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-      - uses: denoland/setup-deno@v2
+      - uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed  # v2
         with: {deno-version: v2.x}
       - name: Run unit tests
         run: deno run --allow-all tests/tea_test.js
@@ -29,7 +29,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
-      - uses: denoland/setup-deno@v2
+      - uses: denoland/setup-deno@22d081ff2d3a40755e97629de92e3bcbfa7cf2ed  # v2
         with: {deno-version: v2.x}
       - name: Run property tests
         run: deno run --allow-all tests/property_test.js
diff --git a/scaffoldia/.github/workflows/comprehensive-quality.yml b/scaffoldia/.github/workflows/comprehensive-quality.yml
index 42dd025f9..709774d08 100644
--- a/scaffoldia/.github/workflows/comprehensive-quality.yml
+++ b/scaffoldia/.github/workflows/comprehensive-quality.yml
@@ -47,7 +47,7 @@ jobs:
             pip install safety && safety check -r requirements.txt || true
           fi
       - name: SAST scan
-        uses: returntocorp/semgrep-action@v1
+        uses: returntocorp/semgrep-action@713efdd345f3035192eaa63f56867b88e63e4e5d  # v1
         continue-on-error: true
   # INTEROPERABILITY - API and format compatibility
   interoperability:
diff --git a/techstack-enforcer/ci-templates/github-action-techstack.yml b/techstack-enforcer/ci-templates/github-action-techstack.yml
index 6d5abc44b..71087adc9 100644
--- a/techstack-enforcer/ci-templates/github-action-techstack.yml
+++ b/techstack-enforcer/ci-templates/github-action-techstack.yml
@@ -43,16 +43,16 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
 
       - name: Checkout techstack-enforcer
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
         with:
           repository: ${{ env.TECHSTACK_REPO }}
           path: techstack-enforcer
 
       - name: Setup Ada/GNAT
-        uses: alire-project/setup-alire@v3
+        uses: alire-project/setup-alire@b607671067a8ca5d7b7f4a12dadb4dc009cd2cc7  # v3
 
       - name: Build techstack-enforcer
         working-directory: techstack-enforcer
@@ -81,18 +81,18 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
         with:
           fetch-depth: 0
 
       - name: Checkout techstack-enforcer
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
         with:
           repository: ${{ env.TECHSTACK_REPO }}
           path: techstack-enforcer
 
       - name: Setup Ada/GNAT
-        uses: alire-project/setup-alire@v3
+        uses: alire-project/setup-alire@b607671067a8ca5d7b7f4a12dadb4dc009cd2cc7  # v3
 
       - name: Build techstack-enforcer
         working-directory: techstack-enforcer
@@ -113,7 +113,7 @@ jobs:
             --mode=$TECHSTACK_MODE
 
       - name: Upload decision report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
         with:
           name: techstack-decisions
           path: changed_files.txt
@@ -127,16 +127,16 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
 
       - name: Checkout techstack-enforcer
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
         with:
           repository: ${{ env.TECHSTACK_REPO }}
           path: techstack-enforcer
 
       - name: Setup Ada/GNAT
-        uses: alire-project/setup-alire@v3
+        uses: alire-project/setup-alire@b607671067a8ca5d7b7f4a12dadb4dc009cd2cc7  # v3
 
       - name: Build techstack-enforcer
         working-directory: techstack-enforcer
@@ -155,7 +155,7 @@ jobs:
             --mode=$TECHSTACK_MODE
 
       - name: Upload audit report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
         with:
           name: techstack-audit
           path: |
@@ -171,16 +171,16 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
 
       - name: Checkout techstack-enforcer
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
         with:
           repository: ${{ env.TECHSTACK_REPO }}
           path: techstack-enforcer
 
       - name: Setup Ada/GNAT
-        uses: alire-project/setup-alire@v3
+        uses: alire-project/setup-alire@b607671067a8ca5d7b7f4a12dadb4dc009cd2cc7  # v3
 
       - name: Build techstack-enforcer
         working-directory: techstack-enforcer
@@ -194,7 +194,7 @@ jobs:
           cat techstack.log || true
 
       - name: Upload learning report
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02  # v4
         with:
           name: techstack-learning
           path: techstack.log
diff --git a/v-ecosystem/v-rest/.github/workflows/k9-svc-validation.yml b/v-ecosystem/v-rest/.github/workflows/k9-svc-validation.yml
index 373f307a2..820ef9aa6 100644
--- a/v-ecosystem/v-rest/.github/workflows/k9-svc-validation.yml
+++ b/v-ecosystem/v-rest/.github/workflows/k9-svc-validation.yml
@@ -4,7 +4,7 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
       - name: Validate contractiles
         run: |
           #!/bin/bash
diff --git a/well-known-ecosystem/.github/workflows/validator.yml b/well-known-ecosystem/.github/workflows/validator.yml
index 64728ad56..19852bd40 100644
--- a/well-known-ecosystem/.github/workflows/validator.yml
+++ b/well-known-ecosystem/.github/workflows/validator.yml
@@ -25,7 +25,9 @@ jobs:
       - name: Checkout
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87  # stable
+        with:
+          toolchain: stable
         with:
           components: clippy, rustfmt
       - name: Cache Cargo
@@ -60,7 +62,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87  # stable
       - name: Cache Cargo
         uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
         with:
diff --git a/zig-ecosystem/bridge-nginx-zig/.github/workflows/security-checks.yml b/zig-ecosystem/bridge-nginx-zig/.github/workflows/security-checks.yml
index b6d07b1b4..b50d9a66e 100644
--- a/zig-ecosystem/bridge-nginx-zig/.github/workflows/security-checks.yml
+++ b/zig-ecosystem/bridge-nginx-zig/.github/workflows/security-checks.yml
@@ -100,10 +100,10 @@ jobs:
   trufflehog:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262  # v4
         with:
           fetch-depth: 0
       - name: TruffleHog Secret Scan
-        uses: trufflesecurity/trufflehog@main
+        uses: trufflesecurity/trufflehog@288a8a8643a2c5a36b81d231c550dccfa0beeb64  # main
         with:
           extra_args: --only-verified --fail