diff --git a/.github/workflows/ash-full-repository-scan.yml b/.github/workflows/ash-full-repository-scan.yml
index 1b0f3222..51a01a48 100644
--- a/.github/workflows/ash-full-repository-scan.yml
+++ b/.github/workflows/ash-full-repository-scan.yml
@@ -17,12 +17,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: '3.10'
 
@@ -112,7 +112,7 @@ jobs:
 
       - name: Upload ASH results as artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: ash-full-scan-${{ github.run_id }}
           path: |
@@ -123,7 +123,7 @@ jobs:
 
       - name: Create issue for critical findings (monthly scan only)
         if: github.event_name == 'schedule' && steps.scan-summary.outputs.has_findings == 'true'
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/ash-security-comment.yml b/.github/workflows/ash-security-comment.yml
index 8e4b5b10..9f98102e 100644
--- a/.github/workflows/ash-security-comment.yml
+++ b/.github/workflows/ash-security-comment.yml
@@ -48,7 +48,7 @@ jobs:
 
       - name: Post comment on PR
         if: steps.pr-info.outputs.pr_number
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/ash-security-scan.yml b/.github/workflows/ash-security-scan.yml
index f00daa2e..edca6185 100644
--- a/.github/workflows/ash-security-scan.yml
+++ b/.github/workflows/ash-security-scan.yml
@@ -13,7 +13,7 @@ jobs:
   scan:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
 
@@ -49,7 +49,7 @@ jobs:
 
       - name: Set up Python
         if: steps.changed-files.outputs.any_changed == 'true'
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: '3.10'
 
@@ -216,7 +216,7 @@ jobs:
 
       - name: Upload ASH results and PR metadata
         if: steps.changed-files.outputs.any_changed == 'true' && always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: ash-security-results
           path: /tmp/ash-artifacts/
diff --git a/.github/workflows/dependabot.yml b/.github/workflows/dependabot.yml
index d82d58a1..a0a73b89 100644
--- a/.github/workflows/dependabot.yml
+++ b/.github/workflows/dependabot.yml
@@ -15,7 +15,7 @@ jobs:
     steps:
       - name: Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v2
+        uses: dependabot/fetch-metadata@21025c705c08248db411dc16f3619e6b5f9ea21a # v2
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
 
diff --git a/.github/workflows/js-lint.yml b/.github/workflows/js-lint.yml
index 7b775685..f088c80e 100644
--- a/.github/workflows/js-lint.yml
+++ b/.github/workflows/js-lint.yml
@@ -17,7 +17,7 @@ jobs:
         working-directory: frontend
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Get changed JS/TS files
         id: changed-files
@@ -34,7 +34,7 @@ jobs:
 
       - name: Set up Node.js
         if: steps.changed-files.outputs.any_changed == 'true'
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: '20'
 
diff --git a/.github/workflows/label.yml b/.github/workflows/label.yml
index 4ebbf042..2673193e 100644
--- a/.github/workflows/label.yml
+++ b/.github/workflows/label.yml
@@ -13,6 +13,6 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/labeler@v5
+      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/python-lint.yml b/.github/workflows/python-lint.yml
index 92d9515c..3db4b344 100644
--- a/.github/workflows/python-lint.yml
+++ b/.github/workflows/python-lint.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Get changed Python files
         id: changed-files
@@ -25,13 +25,13 @@ jobs:
 
       - name: Set up Python
         if: steps.changed-files.outputs.any_changed == 'true'
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: '3.11'
 
       - name: Install uv
         if: steps.changed-files.outputs.any_changed == 'true'
-        uses: astral-sh/setup-uv@v3
+        uses: astral-sh/setup-uv@caf0cab7a618c569241d31dcd442f54681755d39 # v3
 
       - name: Install ruff
         if: steps.changed-files.outputs.any_changed == 'true'