diff --git a/.github/workflows/d-ci.yml b/.github/workflows/d-ci.yml
index ecbb54d7..868d7ac4 100644
--- a/.github/workflows/d-ci.yml
+++ b/.github/workflows/d-ci.yml
@@ -92,7 +92,7 @@ jobs:
               | grep -E '^(proven_path_has_traversal|proven_header_has_crlf|proven_free_string|proven_version|proven_build_info)$' \
               | sort -u | tee /tmp/wired-exports.txt
       - name: Setup D compiler (LDC)
-        uses: dlang-community/setup-dlang@4071ba822f6d0f622ba7359556d11f5827725916 # v1.6.0
+        uses: dlang-community/setup-dlang@0a7469b93f791d83f30932c6fd105796c6966e20 # v2.0.0
         with:
           compiler: ldc-${{ env.LDC_VERSION }}
       - name: D build
@@ -144,7 +144,7 @@ jobs:
             .github/workflows/d-ci.yml
           sparse-checkout-cone-mode: false
       - name: Setup D compiler (LDC)
-        uses: dlang-community/setup-dlang@4071ba822f6d0f622ba7359556d11f5827725916 # v1.6.0
+        uses: dlang-community/setup-dlang@0a7469b93f791d83f30932c6fd105796c6966e20 # v2.0.0
         with:
           compiler: ldc-${{ env.LDC_VERSION }}
       - name: Install just
@@ -182,7 +182,7 @@ jobs:
             .github/workflows/d-ci.yml
           sparse-checkout-cone-mode: false
       - name: Setup D compiler (LDC)
-        uses: dlang-community/setup-dlang@4071ba822f6d0f622ba7359556d11f5827725916 # v1.6.0
+        uses: dlang-community/setup-dlang@0a7469b93f791d83f30932c6fd105796c6966e20 # v2.0.0
         with:
           compiler: ldc-${{ env.LDC_VERSION }}
       - name: Install just
diff --git a/.github/workflows/secret-scanner.yml b/.github/workflows/secret-scanner.yml
index 86bebee9..c2c7ce99 100644
--- a/.github/workflows/secret-scanner.yml
+++ b/.github/workflows/secret-scanner.yml
@@ -23,6 +23,6 @@ jobs:
         with:
           fetch-depth: 0
       - name: TruffleHog Secret Scan
-        uses: trufflesecurity/trufflehog@main
+        uses: trufflesecurity/trufflehog@d411fff7b8879a62509f3fa98c07f247ac089a51 # v3.95.5
         with:
           extra_args: --only-verified --fail
diff --git a/LICENSE b/LICENSE
index 14e2f777..790e9d6e 100644
--- a/LICENSE
+++ b/LICENSE
@@ -1,3 +1,5 @@
+SPDX-License-Identifier: MPL-2.0
+
 Mozilla Public License Version 2.0
 ==================================
 
@@ -370,4 +372,4 @@ Exhibit B - "Incompatible With Secondary Licenses" Notice
 ---------------------------------------------------------
 
   This Source Code Form is "Incompatible With Secondary Licenses", as
-  defined by the Mozilla Public License, v. 2.0.
+  defined by the Mozilla Public License, v. 2.0.
\ No newline at end of file