diff --git a/.github/workflows/asset-size.yml b/.github/workflows/asset-size.yml
index 4b7edad1b..a1ab65d47 100644
--- a/.github/workflows/asset-size.yml
+++ b/.github/workflows/asset-size.yml
@@ -8,7 +8,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - uses: chrysanthos/simple-asset-size-reporter@1.0.2
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 1cf34bb70..fe5100931 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -15,12 +15,12 @@ jobs:
     environment: npm-publish   # binds this job to the approval-gated env
     steps:
       - name: Checkout the tagged commit
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.release.tag_name }}
 
       - name: Set up Node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22.x
           registry-url: 'https://registry.npmjs.org'
@@ -29,7 +29,7 @@ jobs:
         run: npm install -g npm@11.10.0
 
       - name: Install dependencies (honor lockfile)
-        run: npm ci
+        run: npm ci --ignore-scripts
 
       - name: Build dist artifacts
         run: npm run build
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 806319bd7..7d6a01448 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -24,15 +24,15 @@ jobs:
           git config --global core.autocrlf false
           git config --global core.symlinks true
         if: runner.os == 'Windows'
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node-version }}
       - name: Pin npm version
         run: npm install -g npm@11.10.0
       - name: Cache node modules
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.npm
           key: v2-${{ runner.os }}-node-${{ matrix.node-version }}-npm-${{ hashFiles('**/package-lock.json') }}
@@ -49,20 +49,20 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
       - name: Pin npm version
         run: npm install -g npm@11.10.0
       - name: Cache node modules
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.npm
           key: v2-npm-${{ hashFiles('**/package-lock.json') }}
           restore-keys: |
             v2-npm-
-      - run: npm ci
+      - run: npm ci --ignore-scripts
       - run: npm run benchmark
         env:
           CI: true
@@ -73,20 +73,20 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 22
       - name: Pin npm version
         run: npm install -g npm@11.10.0
       - name: Cache node modules
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.npm
           key: v2-npm-${{ hashFiles('**/package-lock.json') }}
           restore-keys: |
             v2-npm-
-      - run: npm ci
+      - run: npm ci --ignore-scripts
       - run: npx tsc -p tsconfig.check.json
         env:
           CI: true