diff --git a/.github/workflows/binary_provenance.yml b/.github/workflows/binary_provenance.yml
index ca891a85f..16201ec81 100644
--- a/.github/workflows/binary_provenance.yml
+++ b/.github/workflows/binary_provenance.yml
@@ -39,15 +39,15 @@ jobs:
           with:
             egress-policy: audit
 
-        - uses: actions/checkout@v7
+        - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-        - uses: actions/download-artifact@v8
+        - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
           with:
             name: ${{inputs.dir}}
             path: ${{ github.workspace }}/${{inputs.dir}}
 
         - name: setup-kosli-cli
-          uses: kosli-dev/setup-cli-action@v5
+          uses: kosli-dev/setup-cli-action@9295a94031a6fc5eb1783a9027649a3cf7d1b950 # v5.2.4
           with:
             version:
                 ${{ vars.KOSLI_CLI_VERSION }}
@@ -59,7 +59,7 @@ jobs:
 
         - name: Attest Build Provenance
           id: artifact-gh-attest
-          uses: actions/attest@v4.2.2
+          uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
           with:
             subject-name: ${{matrix.artifact.template_name}}
             subject-digest: sha256:${{ env.FINGERPRINT }}
@@ -70,7 +70,7 @@ jobs:
             echo "ARTIFACT_TLOG_INDEX=$TRANSPARENCY_LOG_INDEX" >> ${GITHUB_ENV}
 
         - name: Generate SBOM for the binary
-          uses: anchore/sbom-action@v0
+          uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
           with:
             file: ${{matrix.artifact.path}}
             format: 'spdx-json'
@@ -79,7 +79,7 @@ jobs:
             upload-release-assets: false
 
         - name: Generate Cyclone-dx SBOM for the binary
-          uses: anchore/sbom-action@v0
+          uses: anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
           with:
             file: ${{matrix.artifact.path}}
             format: 'cyclonedx-json'
@@ -88,13 +88,13 @@ jobs:
             upload-release-assets: false
 
         - name: Publish SBOM
-          uses: anchore/sbom-action/publish-sbom@v0
+          uses: anchore/sbom-action/publish-sbom@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
           with:
             sbom-artifact-match: ".*\\.spdx.json$"
 
         - name: Attest SBOM to Github
           id: sbom-gh-attest
-          uses: actions/attest@v4.2.2
+          uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
           with:
             sbom-path: '${{matrix.artifact.template_name}}-sbom.spdx.json'
             subject-name: ${{matrix.artifact.template_name}}
diff --git a/.github/workflows/claude-pr-review.yml b/.github/workflows/claude-pr-review.yml
index d9e0f4394..b3741879e 100644
--- a/.github/workflows/claude-pr-review.yml
+++ b/.github/workflows/claude-pr-review.yml
@@ -30,7 +30,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -131,12 +131,12 @@ jobs:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: ".go-version"
           check-latest: true
diff --git a/.github/workflows/daily-cli-tests.yml b/.github/workflows/daily-cli-tests.yml
index 316ae240f..6b3509477 100644
--- a/.github/workflows/daily-cli-tests.yml
+++ b/.github/workflows/daily-cli-tests.yml
@@ -16,7 +16,7 @@ jobs:
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Prepare
         id: prep
@@ -64,15 +64,15 @@ jobs:
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: '.go-version'
           check-latest: true
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
         with:
           role-to-assume: arn:aws:iam::772819027869:role/cli
           aws-region: eu-central-1
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index ab852b4cb..d292f3bc5 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -135,7 +135,7 @@ jobs:
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 3
           # No fetch-tags: the version arrives as a build arg, not from here.
@@ -145,11 +145,11 @@ jobs:
           ref: ${{ inputs.checkout_ref || github.sha }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
         # No QEMU needed — each runner is already native for its platform
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4.7.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -157,7 +157,7 @@ jobs:
 
       - name: Build and push by digest
         id: build
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           build-args: |
@@ -179,7 +179,7 @@ jobs:
           DIGEST: ${{ steps.build.outputs.digest }}
 
       - name: Upload digest artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: digest-${{ matrix.slug }}
           path: /tmp/digests/*
@@ -213,37 +213,37 @@ jobs:
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 3
           # The smoke tests mount this workspace into a container.
           persist-credentials: false
           ref: ${{ inputs.checkout_ref || github.sha }}
 
-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: '.go-version'
           check-latest: true
 
       - name: Download all digest artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           path: /tmp/digests
           pattern: digest-*
           merge-multiple: true
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4.7.0
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: setup-kosli-cli
-        uses: kosli-dev/setup-cli-action@v5
+        uses: kosli-dev/setup-cli-action@9295a94031a6fc5eb1783a9027649a3cf7d1b950 # v5.2.4
         with:
           version: ${{ vars.KOSLI_CLI_VERSION }}
 
@@ -282,14 +282,14 @@ jobs:
           echo "FINGERPRINT=$ARTIFACT_SHA" >> ${GITHUB_ENV}
 
       - name: Attest Build Provenance
-        uses: actions/attest@v4.2.2
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           subject-name: ${{ env.IMAGE }}
           subject-digest: ${{ steps.docker_build.outputs.digest }}
           push-to-registry: true
 
       - name: Install syft
-        uses: anchore/sbom-action/download-syft@v0
+        uses: anchore/sbom-action/download-syft@e22c389904149dbc22b58101806040fa8d37a610 # v0.24.0
 
       - name: Generate SBOM for the docker image
         env:
@@ -321,7 +321,7 @@ jobs:
           fi
 
       - name: Attest SBOM to Github
-        uses: actions/attest@v4.2.2
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           sbom-path: 'sbom.spdx.json'
           subject-name: ${{ env.IMAGE }}
@@ -329,7 +329,7 @@ jobs:
           push-to-registry: true
 
       - name: setup Snyk
-        uses: snyk/actions/setup@master
+        uses: snyk/actions/setup@9adf32b1121593767fc3c057af55b55db032dc04 # v1.0.0
 
       - name: Report Docker image to Kosli
         if: ${{ inputs.report_to_kosli != 'none' }}
diff --git a/.github/workflows/helm-chart.yml b/.github/workflows/helm-chart.yml
index 4c01ad0d5..ded1c3186 100644
--- a/.github/workflows/helm-chart.yml
+++ b/.github/workflows/helm-chart.yml
@@ -23,18 +23,18 @@ jobs:
 
       - name: Generate token
         id: generate_token
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
         with:
           app-id: ${{ vars.CI_SIGNED_COMMIT_APP_ID }}
           private-key: ${{ secrets.CI_SIGNED_COMMIT_APP_PRIVATE_KEY }}
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           token: ${{ steps.generate_token.outputs.token }}
           fetch-depth: 0
 
       - name: Set up Helm
-        uses: azure/setup-helm@v5
+        uses: azure/setup-helm@9bc31f4ebc9c6b171d7bfbaa5d006ae7abdb4310 # v5.0.1
         with:
           version: 'latest'
 
@@ -59,7 +59,7 @@ jobs:
 
       # Configure AWS credentials
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
         with:
           role-to-assume: arn:aws:iam::358426185766:role/cli
           aws-region: eu-central-1
@@ -100,7 +100,7 @@ jobs:
           GH_TOKEN: ${{ steps.generate_token.outputs.token }}
 
       - name: Commit and push changes
-        uses: planetscale/ghcommit-action@v0.2.22
+        uses: planetscale/ghcommit-action@a6b150b81dca5dd027baa898604418eec9e11465 # v0.2.22
         with:
           commit_message: 'Update helm docs'
           repo: ${{ github.repository }}
diff --git a/.github/workflows/init_kosli.yml b/.github/workflows/init_kosli.yml
index bd0eac8f2..9c61875b9 100644
--- a/.github/workflows/init_kosli.yml
+++ b/.github/workflows/init_kosli.yml
@@ -44,18 +44,18 @@ jobs:
           with:
             egress-policy: audit
 
-        - uses: actions/checkout@v7
+        - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
           with:
             fetch-depth: 0
             ref: ${{ inputs.checkout_ref || github.sha }}
 
         - name: setup-kosli-cli
-          uses: kosli-dev/setup-cli-action@v5
+          uses: kosli-dev/setup-cli-action@9295a94031a6fc5eb1783a9027649a3cf7d1b950 # v5.2.4
           with:
             version:
                 ${{ vars.KOSLI_CLI_VERSION }}
 
-        - uses: haya14busa/action-cond@v1
+        - uses: haya14busa/action-cond@94f77f7a80cd666cb3155084e428254fea4281fd # v1.2.1
           id: description
           with:
             cond: ${{ inputs.flow_name == 'cli-release' }}
diff --git a/.github/workflows/install-script-tests.yml b/.github/workflows/install-script-tests.yml
index e24a09b75..2f762fac9 100644
--- a/.github/workflows/install-script-tests.yml
+++ b/.github/workflows/install-script-tests.yml
@@ -38,7 +38,7 @@ jobs:
             egress-policy: audit
 
         - name: Checkout repository
-          uses: actions/checkout@v7
+          uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
         - name: Run install script test
           shell: bash
@@ -57,7 +57,7 @@ jobs:
             egress-policy: audit
 
         - name: Checkout repository
-          uses: actions/checkout@v7
+          uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
         - name: Run Homebrew install 
           shell: bash
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 1c92fc30a..2cd59a21e 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -32,7 +32,7 @@ jobs:
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.pull_request.head.sha || github.sha }}
 
diff --git a/.github/workflows/never_alone_trail.yml b/.github/workflows/never_alone_trail.yml
index 3b21b37cf..93eb3d74d 100644
--- a/.github/workflows/never_alone_trail.yml
+++ b/.github/workflows/never_alone_trail.yml
@@ -45,12 +45,12 @@ jobs:
           with:
             egress-policy: audit
 
-        - uses: actions/checkout@v7
+        - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
           with:
             fetch-depth: 0
 
         - name: setup-kosli-cli
-          uses: kosli-dev/setup-cli-action@v5
+          uses: kosli-dev/setup-cli-action@9295a94031a6fc5eb1783a9027649a3cf7d1b950 # v5.2.4
           with:
             version: ${{ vars.KOSLI_CLI_VERSION }}
 
diff --git a/.github/workflows/pr-checks.yml b/.github/workflows/pr-checks.yml
index f7f0318a1..ec99f6926 100644
--- a/.github/workflows/pr-checks.yml
+++ b/.github/workflows/pr-checks.yml
@@ -26,7 +26,7 @@ jobs:
           egress-policy: audit
 
       - name: PR Conventional Commit Validation
-        uses: ytanikin/pr-conventional-commits@1.5.2
+        uses: ytanikin/pr-conventional-commits@639145d78959c53c43112365837e3abd21ed67c1 # 1.5.2
         with:
           task_types: '["feat","fix","docs","test","ci","refactor","perf","chore","revert"]'
           add_label: 'true'
@@ -46,7 +46,7 @@ jobs:
 
       - name: Label PRs
         id: label-prs
-        uses: actions/labeler@v7
+        uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           sync-labels: true
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ad15373f6..f12a12e6c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -35,11 +35,16 @@ jobs:
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Get tag
         id: tag
-        uses: dawidd6/action-get-tag@v1
+        run: |
+          if [ "$GITHUB_REF_TYPE" != "tag" ]; then
+            echo "::error::Expected a tag ref, got $GITHUB_REF"
+            exit 1
+          fi
+          echo "tag=$GITHUB_REF_NAME" >> "$GITHUB_OUTPUT"
 
       - name: Verify annotated tag
         env:
@@ -141,21 +146,18 @@ jobs:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
-      - name: Install Jq
-        uses: dcarbone/install-jq-action@v4
-
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: '.go-version'
           check-latest: true
 
       - name: Set up Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: '24'
           registry-url: 'https://registry.npmjs.org'
@@ -184,7 +186,7 @@ jobs:
           } >> "$GITHUB_ENV"
 
       - name: Run GoReleaser
-        uses: goreleaser/goreleaser-action@v7
+        uses: goreleaser/goreleaser-action@a4f02ab5355a589de60d917a659ce617ed19b3de # v7.3.0
         with:
           distribution: goreleaser-pro
           version: '~> v2' # latest
@@ -197,7 +199,7 @@ jobs:
       - name: Copy npm packages into dist for provenance
         run: find npm -name "*.tgz" -exec cp {} dist/ \;
 
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: dist
           path: dist
@@ -256,7 +258,7 @@ jobs:
           egress-policy: audit
 
       - name: Repository Dispatch
-        uses: peter-evans/repository-dispatch@v4
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
         with:
           token: ${{ secrets.DOCS_REPO_ACCESS_TOKEN }}
           repository: kosli-dev/docs
@@ -273,7 +275,7 @@ jobs:
           egress-policy: audit
 
       - name: Repository Dispatch
-        uses: peter-evans/repository-dispatch@v4
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
         with:
           token: ${{ secrets.KOSLI_REPORTER_REPO_ACCESS_TOKEN }}
           repository: kosli-dev/terraform-aws-evidence-reporter
@@ -290,7 +292,7 @@ jobs:
           egress-policy: audit
 
       - name: Repository Dispatch
-        uses: peter-evans/repository-dispatch@v4
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
         with:
           token: ${{ secrets.KOSLI_REPORTER_REPO_ACCESS_TOKEN }}
           repository: kosli-dev/terraform-aws-kosli-reporter
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 2e8cacd59..093e9d0d0 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -78,24 +78,24 @@ jobs:
       with:
         egress-policy: audit
 
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         ref: ${{ inputs.checkout_ref || github.sha }}
 
-    - uses: actions/setup-go@v7
+    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
         go-version-file: '.go-version'
         check-latest: true
 
     - name: setup-kosli-cli
-      uses: kosli-dev/setup-cli-action@v5
+      uses: kosli-dev/setup-cli-action@9295a94031a6fc5eb1783a9027649a3cf7d1b950 # v5.2.4
       with:
         version:
           ${{ vars.KOSLI_CLI_VERSION }}
 
     - name: Run golangci-lint
       id: lint
-      uses: golangci/golangci-lint-action@v9
+      uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
       with:
         version: latest
         args: -v
@@ -127,24 +127,24 @@ jobs:
       with:
         egress-policy: audit
 
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 0 # needed for some tests referencing older commits
         ref: ${{ inputs.checkout_ref || github.sha }}
 
-    - uses: actions/setup-go@v7
+    - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
         go-version-file: '.go-version'
         check-latest: true
 
     - name: setup-kosli-cli
-      uses: kosli-dev/setup-cli-action@v5
+      uses: kosli-dev/setup-cli-action@9295a94031a6fc5eb1783a9027649a3cf7d1b950 # v5.2.4
       with:
         version:
           ${{ vars.KOSLI_CLI_VERSION }}
 
     - name: Configure AWS credentials
-      uses: aws-actions/configure-aws-credentials@v6
+      uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
       with:
         role-to-assume: arn:aws:iam::${{ inputs.AWS_ACCOUNT_ID }}:role/cli
         aws-region: ${{ inputs.AWS_REGION }}
@@ -153,7 +153,7 @@ jobs:
 
     - name: Login to Amazon ECR private
       id: login-ecr-private
-      uses: aws-actions/amazon-ecr-login@v2
+      uses: aws-actions/amazon-ecr-login@03f1aad4c6c7ffd436567f42f9384779290529bd # v2.1.7
 
     - name: Run tests
       env:
@@ -187,7 +187,7 @@ jobs:
 
     - name: Upload coverage reports to Codecov
       if: ${{ inputs.report_to_kosli != 'none' }}
-      uses: codecov/codecov-action@v7
+      uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5 # v7.1.1
 
   snyk-code-test:
     if: ${{ inputs.run_snyk }}
@@ -204,15 +204,15 @@ jobs:
       with:
         egress-policy: audit
 
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         ref: ${{ inputs.checkout_ref || github.sha }}
 
     - name: setup Snyk
-      uses: snyk/actions/setup@master
+      uses: snyk/actions/setup@9adf32b1121593767fc3c057af55b55db032dc04 # v1.0.0
 
     - name: setup-kosli-cli
-      uses: kosli-dev/setup-cli-action@v5
+      uses: kosli-dev/setup-cli-action@9295a94031a6fc5eb1783a9027649a3cf7d1b950 # v5.2.4
       with:
         version:
           ${{ vars.KOSLI_CLI_VERSION }}
@@ -257,15 +257,15 @@ jobs:
       with:
         egress-policy: audit
 
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         ref: ${{ inputs.checkout_ref || github.sha }}
 
     - name: setup Snyk
-      uses: snyk/actions/setup@master
+      uses: snyk/actions/setup@9adf32b1121593767fc3c057af55b55db032dc04 # v1.0.0
 
     - name: setup-kosli-cli
-      uses: kosli-dev/setup-cli-action@v5
+      uses: kosli-dev/setup-cli-action@9295a94031a6fc5eb1783a9027649a3cf7d1b950 # v5.2.4
       with:
         version:
           ${{ vars.KOSLI_CLI_VERSION }}
diff --git a/.github/workflows/upload-cli-layer.yml b/.github/workflows/upload-cli-layer.yml
index 0962d7d55..af5baeb60 100644
--- a/.github/workflows/upload-cli-layer.yml
+++ b/.github/workflows/upload-cli-layer.yml
@@ -25,10 +25,10 @@ jobs:
         with:
           egress-policy: audit
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v6
+        uses: aws-actions/configure-aws-credentials@e1253824e5c10ff9df46874f81ed3ec929e19cfd # v6.3.0
         with:
           role-to-assume: arn:aws:iam::${{ inputs.AWS_ACCOUNT_ID }}:role/cli
           aws-region: ${{ inputs.AWS_REGION }}