diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index de679d0..184b67e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -27,7 +27,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install actionlint
         env:
@@ -45,7 +45,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install YAML parser
         run: |
@@ -84,9 +84,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: '3.13'
 
@@ -147,8 +147,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '20'
       - name: Install deploy-check dependencies
@@ -166,6 +166,6 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Verify all gating jobs succeeded
-        uses: re-actors/alls-green@release/v1
+        uses: re-actors/alls-green@b5b5b37504aa4183270bd3d855c52a67f212be35 # release/v1
         with:
           jobs: ${{ toJSON(needs) }}
diff --git a/.github/workflows/container-publish.yml b/.github/workflows/container-publish.yml
index b76402b..2484b21 100644
--- a/.github/workflows/container-publish.yml
+++ b/.github/workflows/container-publish.yml
@@ -50,10 +50,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # This repository at the release the caller pinned, for the script below.
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: JorisJonkers-dev/github-workflows
           ref: v0.35.0 # x-release-please-version
@@ -68,12 +68,12 @@ jobs:
           OVERRIDE: ${{ inputs.software-version }}
         run: bash .github-workflows/actions/container-publish/software-version.sh
 
-      - uses: docker/setup-qemu-action@v4
+      - uses: docker/setup-qemu-action@99012661954931238ded8c8b007157a8430204e1 # v4.4.0
 
-      - uses: docker/setup-buildx-action@v4
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Log in to GHCR
-        uses: docker/login-action@v4
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -104,7 +104,7 @@ jobs:
           } >> "$GITHUB_OUTPUT"
 
       - name: Build and publish image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: ${{ inputs.context }}
           file: ${{ inputs.dockerfile }}
diff --git a/.github/workflows/crac-train.yml b/.github/workflows/crac-train.yml
index 5a91cf9..a390dd4 100644
--- a/.github/workflows/crac-train.yml
+++ b/.github/workflows/crac-train.yml
@@ -66,9 +66,9 @@ jobs:
       matrix:
         include: ${{ fromJSON(inputs.service-matrix) }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: docker/setup-buildx-action@v4
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Resolve requested sidecars
         id: sidecars
@@ -199,7 +199,7 @@ jobs:
           exit 1
 
       - name: Build training image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: ${{ matrix.context || '.' }}
           file: ${{ matrix.dockerfile }}
@@ -295,7 +295,7 @@ jobs:
         run: |
           docker rm -f crac-postgres crac-valkey crac-rabbitmq >/dev/null 2>&1 || true
 
-      - uses: actions/upload-artifact@v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: ${{ matrix.service }}-checkpoint
           path: checkpoint/
diff --git a/.github/workflows/deploy-artifact.yml b/.github/workflows/deploy-artifact.yml
index 87dd551..761a2e1 100644
--- a/.github/workflows/deploy-artifact.yml
+++ b/.github/workflows/deploy-artifact.yml
@@ -84,12 +84,12 @@ jobs:
 
     steps:
       # Checkout the service repository at the requested ref
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: ${{ inputs.ref }}
 
       # Checkout github-workflows at the workflow SHA so actions are in sync
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           repository: JorisJonkers-dev/github-workflows
           ref: v0.35.0 # x-release-please-version
@@ -104,7 +104,7 @@ jobs:
       # The lock is always consumed from deploy-dir/images.lock.json after download.
       - name: Download image lock artifact
         if: ${{ inputs.image-lock-artifact != '' }}
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ inputs.image-lock-artifact }}
           path: ${{ inputs.deploy-dir }}
@@ -141,7 +141,7 @@ jobs:
 
       - name: Attest build provenance
         if: ${{ steps.publish.outputs.artifact-digest != '' }}
-        uses: actions/attest-build-provenance@0f67c3f4856b2e3261c31976d6725780e5e4c373 # v4.1.1
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
         with:
           subject-name: ghcr.io/jorisjonkers-dev/${{ inputs.artifact-name }}
           subject-digest: ${{ steps.publish.outputs.artifact-digest }}
@@ -177,7 +177,7 @@ jobs:
             | python3 -m json.tool --indent 2 > gate-summary.json
 
       # Always upload gate-summary-deploy-artifact, even when render failed (SC-4)
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: gate-summary-deploy-artifact
diff --git a/.github/workflows/deploy-config-render-drift.yml b/.github/workflows/deploy-config-render-drift.yml
index ed6a420..1ed9cf0 100644
--- a/.github/workflows/deploy-config-render-drift.yml
+++ b/.github/workflows/deploy-config-render-drift.yml
@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Resolve workflow ref
         id: workflow-ref
@@ -55,7 +55,7 @@ jobs:
 
           printf 'ref=%s\n' "$ref" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: JorisJonkers-dev/github-workflows
           ref: v0.35.0 # x-release-please-version
diff --git a/.github/workflows/deploy-validate.yml b/.github/workflows/deploy-validate.yml
index 2d6f6ca..c2612df 100644
--- a/.github/workflows/deploy-validate.yml
+++ b/.github/workflows/deploy-validate.yml
@@ -54,14 +54,14 @@ jobs:
       gate-summary-artifact: gate-summary-deploy-validate
 
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # Checkout github-workflows at this workflow file's own released version.
       # github.job_workflow_sha is empty inside a reusable workflow, which made
       # actions/checkout silently fall back to the default branch, so every
       # consumer ran main regardless of the tag it pinned. release-please keeps
       # the literal below in step with the tag this file ships in.
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           repository: JorisJonkers-dev/github-workflows
           ref: v0.35.0 # x-release-please-version
@@ -79,13 +79,13 @@ jobs:
           comment: ${{ inputs.comment }}
 
       # Always upload both artifacts so downstream consumers can rely on them (SC-4)
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: gate-summary-deploy-validate
           path: gate-summary.json
 
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: deploy-preview-summary
diff --git a/.github/workflows/docker-image-ci.yml b/.github/workflows/docker-image-ci.yml
index a065e88..294b657 100644
--- a/.github/workflows/docker-image-ci.yml
+++ b/.github/workflows/docker-image-ci.yml
@@ -42,9 +42,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: docker/setup-buildx-action@v4
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Resolve image reference
         id: image
@@ -65,7 +65,7 @@ jobs:
           printf 'tag=%s:ci-%s\n' "$image_ref" "$GITHUB_SHA" >> "$GITHUB_OUTPUT"
 
       - name: Build image
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: ${{ inputs.context }}
           file: ${{ inputs.dockerfile }}
diff --git a/.github/workflows/flux-render-validate.yml b/.github/workflows/flux-render-validate.yml
index 5199c85..549bcf1 100644
--- a/.github/workflows/flux-render-validate.yml
+++ b/.github/workflows/flux-render-validate.yml
@@ -37,7 +37,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Resolve workflow ref
         id: workflow-ref
@@ -55,7 +55,7 @@ jobs:
 
           printf 'ref=%s\n' "$ref" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: JorisJonkers-dev/github-workflows
           ref: v0.35.0 # x-release-please-version
diff --git a/.github/workflows/gitops-ci.yml b/.github/workflows/gitops-ci.yml
index f4f92b6..81b5444 100644
--- a/.github/workflows/gitops-ci.yml
+++ b/.github/workflows/gitops-ci.yml
@@ -44,7 +44,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Resolve workflow ref
         id: workflow-ref
@@ -62,7 +62,7 @@ jobs:
 
           printf 'ref=%s\n' "$ref" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: JorisJonkers-dev/github-workflows
           ref: v0.35.0 # x-release-please-version
diff --git a/.github/workflows/jvm-ci.yml b/.github/workflows/jvm-ci.yml
index e511812..7d765d4 100644
--- a/.github/workflows/jvm-ci.yml
+++ b/.github/workflows/jvm-ci.yml
@@ -57,9 +57,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: JorisJonkers-dev/github-workflows
           ref: v0.35.0 # x-release-please-version
@@ -81,9 +81,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: JorisJonkers-dev/github-workflows
           ref: v0.35.0 # x-release-please-version
diff --git a/.github/workflows/leak-scan.yml b/.github/workflows/leak-scan.yml
index 51ff9db..1eb029c 100644
--- a/.github/workflows/leak-scan.yml
+++ b/.github/workflows/leak-scan.yml
@@ -53,7 +53,7 @@ jobs:
 
     steps:
       # fetch-depth: 0 is required for all-refs and pr-diff modes
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
 
@@ -62,7 +62,7 @@ jobs:
       # actions/checkout silently fall back to the default branch, so every
       # consumer ran main regardless of the tag it pinned. release-please keeps
       # the literal below in step with the tag this file ships in.
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           repository: JorisJonkers-dev/github-workflows
           ref: v0.35.0 # x-release-please-version
@@ -80,7 +80,7 @@ jobs:
           exclude-paths: ${{ inputs.exclude-paths }}
 
       # Always upload gate-summary-leak-scan (SC-4 fail-safe)
-      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: gate-summary-leak-scan
diff --git a/.github/workflows/migration-guard.yml b/.github/workflows/migration-guard.yml
index ec5d24a..da49ce9 100644
--- a/.github/workflows/migration-guard.yml
+++ b/.github/workflows/migration-guard.yml
@@ -34,7 +34,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -54,7 +54,7 @@ jobs:
 
           printf 'ref=%s\n' "$ref" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: JorisJonkers-dev/github-workflows
           ref: v0.35.0 # x-release-please-version
diff --git a/.github/workflows/mutation-report.yml b/.github/workflows/mutation-report.yml
index 82b2373..6770905 100644
--- a/.github/workflows/mutation-report.yml
+++ b/.github/workflows/mutation-report.yml
@@ -38,13 +38,13 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
 
       # Checkout github-workflows at this workflow file's own released version; release-please
       # keeps the literal in step with the tag this file ships in.
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           repository: JorisJonkers-dev/github-workflows
           ref: v0.35.0 # x-release-please-version
diff --git a/.github/workflows/nix-ci.yml b/.github/workflows/nix-ci.yml
index fdf3a81..406d968 100644
--- a/.github/workflows/nix-ci.yml
+++ b/.github/workflows/nix-ci.yml
@@ -43,9 +43,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: cachix/install-nix-action@v31
+      - uses: cachix/install-nix-action@75c75c31ebece974e48ebc36b4ad125bd97bd97b # 31.11.3
 
       - name: Check Nix formatting
         working-directory: ${{ inputs.flake-path }}
diff --git a/.github/workflows/node-ci.yml b/.github/workflows/node-ci.yml
index 280cf5d..6e47897 100644
--- a/.github/workflows/node-ci.yml
+++ b/.github/workflows/node-ci.yml
@@ -73,7 +73,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Resolve workflow ref
         id: workflow-ref
@@ -91,7 +91,7 @@ jobs:
 
           printf 'ref=%s\n' "$ref" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: JorisJonkers-dev/github-workflows
           ref: v0.35.0 # x-release-please-version
diff --git a/.github/workflows/path-buckets.yml b/.github/workflows/path-buckets.yml
index 16ba0b1..b6c8c2c 100644
--- a/.github/workflows/path-buckets.yml
+++ b/.github/workflows/path-buckets.yml
@@ -43,12 +43,12 @@ jobs:
     outputs:
       run: ${{ steps.buckets.outputs.run }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: JorisJonkers-dev/github-workflows
           ref: v0.35.0 # x-release-please-version
diff --git a/.github/workflows/platform-config-validate.yml b/.github/workflows/platform-config-validate.yml
index f3b68f9..54c1ded 100644
--- a/.github/workflows/platform-config-validate.yml
+++ b/.github/workflows/platform-config-validate.yml
@@ -46,7 +46,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Resolve workflow ref
         id: workflow-ref
@@ -64,7 +64,7 @@ jobs:
 
           printf 'ref=%s\n' "$ref" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: JorisJonkers-dev/github-workflows
           ref: v0.35.0 # x-release-please-version
diff --git a/.github/workflows/pr-title-check.yml b/.github/workflows/pr-title-check.yml
index ccc8223..02b244a 100644
--- a/.github/workflows/pr-title-check.yml
+++ b/.github/workflows/pr-title-check.yml
@@ -18,7 +18,7 @@ jobs:
     timeout-minutes: 5
     steps:
       # The pull request's head, not the merge commit, so the range holds only its own commits.
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 0
@@ -26,7 +26,7 @@ jobs:
 
       # Checkout github-workflows at this workflow file's own released version; release-please
       # keeps the literal in step with the tag this file ships in.
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           repository: JorisJonkers-dev/github-workflows
           ref: v0.35.0 # x-release-please-version
diff --git a/.github/workflows/production-canary.yml b/.github/workflows/production-canary.yml
index 58a353b..1228bf7 100644
--- a/.github/workflows/production-canary.yml
+++ b/.github/workflows/production-canary.yml
@@ -57,7 +57,7 @@ jobs:
     timeout-minutes: ${{ inputs.timeout-minutes }}
     if: ${{ inputs.enabled }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Wait after push
         if: ${{ github.event_name == 'push' && inputs.post-push-delay-seconds > 0 }}
diff --git a/.github/workflows/publish-api-clients.yml b/.github/workflows/publish-api-clients.yml
index cf01c22..f99d403 100644
--- a/.github/workflows/publish-api-clients.yml
+++ b/.github/workflows/publish-api-clients.yml
@@ -61,9 +61,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           repository: JorisJonkers-dev/github-workflows
           ref: v0.35.0 # x-release-please-version
@@ -77,7 +77,7 @@ jobs:
 
       # Install Node + configure the GitHub Packages registry only. Do NOT install here —
       # the typescript project is created by api-client-publish, which runs npm install itself.
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ inputs.node-version }}
           registry-url: ${{ inputs.npm-registry-url }}
diff --git a/.github/workflows/publish-fragment.yml b/.github/workflows/publish-fragment.yml
index 8f77ac3..04ce7dd 100644
--- a/.github/workflows/publish-fragment.yml
+++ b/.github/workflows/publish-fragment.yml
@@ -128,7 +128,7 @@ jobs:
           path: .github-workflows
           persist-credentials: false
 
-      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ inputs.node-version }}
           registry-url: https://npm.pkg.github.com
@@ -151,7 +151,7 @@ jobs:
 
       - name: Fetch the migration proof
         if: ${{ inputs.migration-proof-artifact != '' }}
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ inputs.migration-proof-artifact }}
           path: .migration-proof
@@ -169,7 +169,7 @@ jobs:
 
       - name: Fetch the images lock
         if: ${{ inputs.images-lock-artifact != '' }}
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: ${{ inputs.images-lock-artifact }}
           path: ${{ runner.temp }}/images-lock
@@ -179,7 +179,7 @@ jobs:
           version: 1.3.4
       - uses: sigstore/cosign-installer@7e8b541eb2e61bf99390e1afd4be13a184e9ebc5 # v3.10.1
         with:
-          cosign-release: v2.6.1
+          cosign-release: v2.6.5
       - name: Pull the fragments the project file is validated beside
         id: beside
         if: ${{ inputs.validate-with-fragments != '' }}
@@ -251,7 +251,7 @@ jobs:
       - name: Mint a token for the Estate repository
         id: estate
         if: ${{ inputs.compose }}
-        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           app-id: ${{ vars.ESTATE_DISPATCH_APP_ID }}
           private-key: ${{ secrets.ESTATE_DISPATCH_APP_PRIVATE_KEY }}
diff --git a/.github/workflows/python-ci.yml b/.github/workflows/python-ci.yml
index 21b50db..fb898b2 100644
--- a/.github/workflows/python-ci.yml
+++ b/.github/workflows/python-ci.yml
@@ -43,9 +43,9 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: ${{ inputs.python-version }}
 
diff --git a/.github/workflows/quarantine-check.yml b/.github/workflows/quarantine-check.yml
index b5d7143..41dfc95 100644
--- a/.github/workflows/quarantine-check.yml
+++ b/.github/workflows/quarantine-check.yml
@@ -16,13 +16,13 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           persist-credentials: false
 
       # Checkout github-workflows at this workflow file's own released version; release-please
       # keeps the literal in step with the tag this file ships in.
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           repository: JorisJonkers-dev/github-workflows
           ref: v0.35.0 # x-release-please-version
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 2470f5f..125a41c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -29,13 +29,13 @@ jobs:
       # default GITHUB_TOKEN) so CI runs on the PR without a manual approval
       # gate. Best-effort: falls back to GITHUB_TOKEN when the App secrets or
       # installation are absent.
-      - uses: actions/create-github-app-token@v3
+      - uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         id: app-token
         continue-on-error: true
         with:
           app-id: ${{ secrets.RELEASE_APP_ID }}
           private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
-      - uses: googleapis/release-please-action@v5
+      - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
         id: rp
         with:
           token: ${{ steps.app-token.outputs.token || secrets.GITHUB_TOKEN }}
@@ -60,9 +60,9 @@ jobs:
       - name: Publish tag-ref deliverable
         run: echo "Released ${{ needs.release-please.outputs.tag_name }}"
 
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '20'
           registry-url: https://npm.pkg.github.com
diff --git a/.github/workflows/tofu-ci.yml b/.github/workflows/tofu-ci.yml
index e437395..25038c0 100644
--- a/.github/workflows/tofu-ci.yml
+++ b/.github/workflows/tofu-ci.yml
@@ -68,7 +68,7 @@ jobs:
       run:
         working-directory: ${{ inputs.working-directory }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install OpenTofu
         env:
diff --git a/actions/deploy-bundle/action.yml b/actions/deploy-bundle/action.yml
index 6eebd95..8f602ff 100644
--- a/actions/deploy-bundle/action.yml
+++ b/actions/deploy-bundle/action.yml
@@ -49,7 +49,7 @@ outputs:
 runs:
   using: 'composite'
   steps:
-    - uses: 'actions/setup-node@v6'
+    - uses: 'actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38' # v6.5.0
       with:
         node-version: '24'
 
diff --git a/actions/deploy-config-render-drift/action.yml b/actions/deploy-config-render-drift/action.yml
index 1392215..ba284e5 100644
--- a/actions/deploy-config-render-drift/action.yml
+++ b/actions/deploy-config-render-drift/action.yml
@@ -24,7 +24,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/setup-node@v6
+    - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
       with:
         node-version: '24'
 
diff --git a/actions/deploy-sources-render/action.yml b/actions/deploy-sources-render/action.yml
index aa281d1..04321b7 100644
--- a/actions/deploy-sources-render/action.yml
+++ b/actions/deploy-sources-render/action.yml
@@ -63,7 +63,7 @@ outputs:
 runs:
   using: 'composite'
   steps:
-    - uses: 'actions/setup-node@v6'
+    - uses: 'actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38' # v6.5.0
       with:
         node-version: '24'
 
diff --git a/actions/flux-render-validate/action.yml b/actions/flux-render-validate/action.yml
index f0eb7ea..9b5bb5b 100644
--- a/actions/flux-render-validate/action.yml
+++ b/actions/flux-render-validate/action.yml
@@ -37,7 +37,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       with:
         repository: ${{ inputs.crd-catalog-source }}
         ref: ${{ inputs.crd-catalog-ref }}
diff --git a/actions/platform-config-validate/action.yml b/actions/platform-config-validate/action.yml
index 1e5046b..0fbf741 100644
--- a/actions/platform-config-validate/action.yml
+++ b/actions/platform-config-validate/action.yml
@@ -32,7 +32,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/setup-node@v6
+    - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
       with:
         node-version: '24'
 
diff --git a/actions/prepare-ci-host/action.yml b/actions/prepare-ci-host/action.yml
index ccbb692..884dd1f 100644
--- a/actions/prepare-ci-host/action.yml
+++ b/actions/prepare-ci-host/action.yml
@@ -30,7 +30,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: actions/download-artifact@v8
+    - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
       with:
         pattern: ${{ inputs.artifact-pattern }}
         path: ${{ inputs.artifact-path }}
diff --git a/actions/resolve-image-lock/action.yml b/actions/resolve-image-lock/action.yml
index 49686a8..edec3f6 100644
--- a/actions/resolve-image-lock/action.yml
+++ b/actions/resolve-image-lock/action.yml
@@ -59,7 +59,7 @@ runs:
         ARTIFACT: ${{ inputs.artifact-name || format('images-lock-{0}', github.run_id) }}
       run: echo "artifact=${ARTIFACT}" >> "$GITHUB_OUTPUT"
 
-    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+    - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
         name: ${{ steps.name.outputs.artifact }}
         path: ${{ runner.temp }}/resolve-image-lock/images.lock.yml
diff --git a/actions/setup-java-gradle/action.yml b/actions/setup-java-gradle/action.yml
index 2e4727e..50e8bff 100644
--- a/actions/setup-java-gradle/action.yml
+++ b/actions/setup-java-gradle/action.yml
@@ -46,12 +46,12 @@ runs:
           printf 'GITHUB_TOKEN=%s\n' "$GITHUB_PACKAGES_TOKEN"
         } >> "$GITHUB_ENV"
 
-    - uses: actions/setup-java@v5
+    - uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
       with:
         distribution: ${{ inputs.java-distribution }}
         java-version: ${{ inputs.java-version }}
 
-    - uses: gradle/actions/setup-gradle@v6
+    - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
       with:
         cache-disabled: ${{ inputs.gradle-cache-disabled }}
         cache-read-only: ${{ inputs.gradle-cache-read-only != '' && inputs.gradle-cache-read-only || !(github.event_name == 'push' && github.ref_name == github.event.repository.default_branch) }}
diff --git a/actions/setup-node/action.yml b/actions/setup-node/action.yml
index dc38538..9395612 100644
--- a/actions/setup-node/action.yml
+++ b/actions/setup-node/action.yml
@@ -59,11 +59,11 @@ runs:
 
     - name: Set up pnpm
       if: ${{ inputs.package-manager == 'pnpm' }}
-      uses: pnpm/action-setup@v6
+      uses: pnpm/action-setup@ea17c68df8912ef543352723c149a84f56e3d413 # v6.1.0
 
     # Only a push to the default branch saves the cache; other runs restore its latest below, so
     # pull requests never evict it from the repository's 10 GB.
-    - uses: actions/setup-node@v6
+    - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
       with:
         node-version: ${{ inputs.node-version }}
         cache: ${{ (github.event_name == 'push' && github.ref_name == github.event.repository.default_branch) && inputs.package-manager || '' }}