diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 00000000..2c48305b
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/build-devcontainer-template.yml b/.github/workflows/build-devcontainer-template.yml
index 884e6f5e..19f55b3b 100644
--- a/.github/workflows/build-devcontainer-template.yml
+++ b/.github/workflows/build-devcontainer-template.yml
@@ -50,7 +50,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: ${{ inputs.fetch-depth }}
           submodules: false
@@ -64,7 +64,7 @@ jobs:
 
       # Free up disk space but keep Docker images
       - name: Free disk space
-        uses: jlumbroso/free-disk-space@v1.3.1
+        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
         with:
           android: true
           dotnet: true
@@ -74,10 +74,10 @@ jobs:
           tool-cache: true
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Build devcontainer image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           context: .devcontainer
           load: true
diff --git a/.github/workflows/build-targets-template.yml b/.github/workflows/build-targets-template.yml
index ae0df497..d76fcd5d 100644
--- a/.github/workflows/build-targets-template.yml
+++ b/.github/workflows/build-targets-template.yml
@@ -97,7 +97,7 @@ jobs:
           echo "CCACHE_DIR=$RUNNER_TEMP/.ccache" >> "$GITHUB_ENV"
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: ${{ inputs.fetch-depth }}
           submodules: false
@@ -112,7 +112,7 @@ jobs:
       # Free up some disk space - this is a major constraint on GitHub-hosted runners
       - name: Free disk space
         if: runner.os == 'Linux'
-        uses: jlumbroso/free-disk-space@v1.3.1
+        uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
         with:
           android: true
           dotnet: true
@@ -153,7 +153,7 @@ jobs:
 
       # Restore ccache across runs. Cache key includes compiler id+version, CIRCT sha, CMake build type, and build/cmake/circt.cmake hash.
       - name: Restore ccache
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: ${{ env.CCACHE_DIR }}
           key: >
@@ -166,14 +166,14 @@ jobs:
 
       - name: Install Haskell
         id: haskell
-        uses: haskell-actions/setup@v2
+        uses: haskell-actions/setup@6037f33647c3f17758a2356c80fc4a53d7e0685d # v2.12.0
         with:
           ghc-version: '9.6.7'
           cabal-version: '3.12.1.0'
           enable-stack: false
 
       - name: Cache ghcup & cabal store
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.ghcup
@@ -186,20 +186,20 @@ jobs:
         run: cabal update
 
       - name: Init ccache
-        uses: hendrikmuhs/ccache-action@v1
+        uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2.20
         with:
           max-size: ${{ env.CCACHE_MAXSIZE }}
           verbose: 1
 
       - name: Install Verilator
         if: runner.os == 'Linux'
-        uses: veryl-lang/setup-verilator@v1
+        uses: veryl-lang/setup-verilator@b155747595eb4b817473a83045ba1da581c4084b # v1.0.3
         with:
           version: '5.040'
 
       - name: Install Boost
         id: install_boost
-        uses: MarkusJx/install-boost@v2
+        uses: MarkusJx/install-boost@f9d34f6fe427b8f2ae424d7bf2a3ebccb0dae5a3 # v2.6.0
         with:
           boost_version: ${{ env.BOOST_VERSION }}   # e.g. "1.88.0"
           platform_version: ${{ inputs.boost-platform-version }}
@@ -209,11 +209,11 @@ jobs:
 
       - name: Install pandoc
         if: ${{ inputs.install-pandoc }}
-        uses: pandoc/actions/setup@v1
+        uses: pandoc/actions/setup@86321b6dd4675f5014c611e05088e10d4939e09e # v1.1.1
 
       - name: Install Rust toolchain
         if: ${{ inputs.install-rust }}
-        uses: actions-rust-lang/setup-rust-toolchain@v1
+        uses: actions-rust-lang/setup-rust-toolchain@166cdcfd11aee3cb47222f9ddb555ce30ddb9659 # v1.17.0
         with:
           toolchain: stable
           cache: true
@@ -323,7 +323,7 @@ jobs:
 
       - name: Setup MSVC Developer Command Prompt
         if: runner.os == 'Windows'
-        uses: ilammy/msvc-dev-cmd@v1
+        uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1.13.0
 
       - name: Configure (CMake Generate)
         shell: bash
@@ -378,7 +378,7 @@ jobs:
 
       - name: Upload artifacts
         if: ${{ inputs.artifact-name != '' }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: ${{ inputs.artifact-name }}
           path: ${{ inputs.artifact-path }}
diff --git a/.github/workflows/nightly-prerelease.yml b/.github/workflows/nightly-prerelease.yml
index 31f100f2..bd0d2ca0 100644
--- a/.github/workflows/nightly-prerelease.yml
+++ b/.github/workflows/nightly-prerelease.yml
@@ -23,7 +23,7 @@ jobs:
       has-changes: ${{ steps.check.outputs.has-changes }}
     steps:
       # Sparse checkout of only the VERSION file
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
           sparse-checkout: |
@@ -115,7 +115,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           path: dist
       - name: Flatten artifact layout
@@ -131,7 +131,7 @@ jobs:
           cd out
           for f in *; do [ -f "$f" ] || continue; shasum -a 256 "$f" > "$f.sha256"; done
       - name: Create/Update prerelease
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
         with:
           tag_name: ${{ needs.prepare.outputs.tag }}
           name: Nightly ${{ needs.prepare.outputs.date }}
diff --git a/.github/workflows/publish-libdoc.yml b/.github/workflows/publish-libdoc.yml
index 4f76711c..47c80372 100644
--- a/.github/workflows/publish-libdoc.yml
+++ b/.github/workflows/publish-libdoc.yml
@@ -31,13 +31,13 @@ jobs:
 
     steps:
       - name: Download library docs artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: 'library-docs-${{ github.sha }}'
           path: library-docs
 
       - name: Publish to GitHub Pages
-        uses: peaceiris/actions-gh-pages@v4
+        uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4.1.0
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./library-docs
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 24066312..9f966d1b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -20,7 +20,7 @@ jobs:
       extra_args: ${{ steps.v.outputs.extra_args }}
       artifact_prefix: ${{ steps.v.outputs.artifact_prefix }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
           submodules: false
@@ -100,7 +100,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Download all artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           path: dist
       - name: Flatten artifact layout
@@ -116,7 +116,7 @@ jobs:
           cd out
           for f in *; do [ -f "$f" ] || continue; shasum -a 256 "$f" > "$f.sha256"; done
       - name: Publish GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
         with:
           tag_name: ${{ needs.prepare.outputs.tag }}
           name: ${{ needs.prepare.outputs.tag }}