diff --git a/.github/workflows/gen_coverage_report.yml b/.github/workflows/gen_coverage_report.yml
index 04c87c4e92..da11397c23 100644
--- a/.github/workflows/gen_coverage_report.yml
+++ b/.github/workflows/gen_coverage_report.yml
@@ -18,17 +18,17 @@ jobs:
       id-token: write
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           token: ${{ secrets.GH_CQ_BOT }}
       - name: Set up Go 1.x
         id: setup-go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
         with:
           go-version: "1.26"
           cache: false
       - name: Cache Go modules
-        uses: actions/cache@v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: |
             ~/go/pkg/mod
@@ -41,7 +41,7 @@ jobs:
         run: make coverage
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8
         with:
           # required so the PR triggers workflow runs
           token: ${{ secrets.GH_CQ_BOT }}
diff --git a/.github/workflows/go_mod_tidy_examples.yml b/.github/workflows/go_mod_tidy_examples.yml
index 2bfd4b1aa5..2f7dd4a9db 100644
--- a/.github/workflows/go_mod_tidy_examples.yml
+++ b/.github/workflows/go_mod_tidy_examples.yml
@@ -17,17 +17,17 @@ jobs:
       matrix:
         plugin: [simple_plugin]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           token: ${{ secrets.GH_CQ_BOT }}
       - name: Set up Go 1.x
         id: setup-go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
         with:
           go-version-file: go.mod
           cache: false
       - name: Cache Go modules
-        uses: actions/cache@v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: |
             ~/go/pkg/mod
@@ -39,6 +39,6 @@ jobs:
       - name: Run go mod tidy
         working-directory: examples/${{ matrix.plugin }}
         run: go mod tidy
-      - uses: stefanzweifel/git-auto-commit-action@v7
+      - uses: stefanzweifel/git-auto-commit-action@04702edda442b2e678b25b537cec683a1493fcb9 # v7
         with:
             commit_message: "chore: Tidy"
diff --git a/.github/workflows/lint_golang.yml b/.github/workflows/lint_golang.yml
index f45f30caeb..c975ae4727 100644
--- a/.github/workflows/lint_golang.yml
+++ b/.github/workflows/lint_golang.yml
@@ -16,14 +16,14 @@ jobs:
     runs-on: ubicloud-standard-8
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
         id: setup-go
         with:
           go-version-file: go.mod
           cache: false
       - name: Cache Go modules
-        uses: actions/cache@v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: |
             ~/go/pkg/mod
@@ -33,6 +33,6 @@ jobs:
             ${{ runner.os }}-go-${{ steps.setup-go.outputs.go-version }}-
             ${{ runner.os }}-go-
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v9
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9
         with:
           version: v2.10.1
diff --git a/.github/workflows/lint_markdown.yml b/.github/workflows/lint_markdown.yml
index 7e53e382df..11c3fd5b11 100644
--- a/.github/workflows/lint_markdown.yml
+++ b/.github/workflows/lint_markdown.yml
@@ -15,7 +15,7 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Git checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - run: |
           venv="$HOME/.local/share/venv"
           python3 -m venv "$venv"
@@ -33,9 +33,9 @@ jobs:
     timeout-minutes: 10
     steps:
       - name: Git checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: markdownlint-cli
-        uses: nosborn/github-action-markdown-cli@v3.5.0
+        uses: nosborn/github-action-markdown-cli@508d6cefd8f0cc99eab5d2d4685b1d5f470042c1 # v3.5.0
         with:
           files: .
           config_file: .markdownlint.yaml
diff --git a/.github/workflows/pr_title.yml b/.github/workflows/pr_title.yml
index 9443f7aafa..a079af175b 100644
--- a/.github/workflows/pr_title.yml
+++ b/.github/workflows/pr_title.yml
@@ -18,7 +18,7 @@ jobs:
     steps:
       # Please look up the latest version from
       # https://github.com/amannn/action-semantic-pull-request/releases
-      - uses: amannn/action-semantic-pull-request@v6
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
diff --git a/.github/workflows/release-pr.yml b/.github/workflows/release-pr.yml
index 212ea7a500..fa76947c98 100644
--- a/.github/workflows/release-pr.yml
+++ b/.github/workflows/release-pr.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: googleapis/release-please-action@v4
+      - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4
         id: release
         with:
           token: ${{ secrets.GH_CQ_BOT }}
@@ -31,7 +31,7 @@ jobs:
         with:
           prerelease: true
       - name: Trigger Renovate
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         if: steps.release.outputs.release_created && steps.semver_parser.outputs.prerelease == ''
         with:
           github-token: ${{ secrets.GH_CQ_BOT }}
diff --git a/.github/workflows/unittest-post.yml b/.github/workflows/unittest-post.yml
index 39583ba50e..336e6dd8c6 100644
--- a/.github/workflows/unittest-post.yml
+++ b/.github/workflows/unittest-post.yml
@@ -16,9 +16,9 @@ jobs:
     timeout-minutes: 10
     steps:
       # This posts the status to the PR/commit
-      - uses: haya14busa/action-workflow_run-status@v1
+      - uses: haya14busa/action-workflow_run-status@967ed83efa565c257675ed70cfe5231f062ddd94 # v1
       - name: Download benchmarks
-        uses: dawidd6/action-download-artifact@v15
+        uses: dawidd6/action-download-artifact@fe9d59ce33ce92db8a6ac90b2c8be6b6d90417c8 # v15
         with:
           # This is the workflow that triggered this run
           workflow: ${{ github.event.workflow.id }}
@@ -30,7 +30,7 @@ jobs:
         id: pr_number
         run: echo "pr_number=$(cat pr_number)" >> $GITHUB_OUTPUT
       - name: Post deltas to GitHub
-        uses: netlify/delta-action@v4
+        uses: netlify/delta-action@1195810c67610e177b2f60da3f4cf6f620bd5d54 # v4
         with:
           title: "⏱️ Benchmark results"
           style: "text"
diff --git a/.github/workflows/unittest.yml b/.github/workflows/unittest.yml
index e71204e291..f214193da5 100644
--- a/.github/workflows/unittest.yml
+++ b/.github/workflows/unittest.yml
@@ -19,10 +19,10 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Set up Go 1.x
         id: setup-go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4b73464bb391d4059bd26b0524d20df3927bd417 # v6
         with:
           go-version-file: go.mod
           cache: false
@@ -33,7 +33,7 @@ jobs:
           echo "gocache=$(go env GOCACHE)" >> "$GITHUB_OUTPUT"
           echo "gomodcache=$(go env GOMODCACHE)" >> "$GITHUB_OUTPUT"
       - name: Cache Go modules
-        uses: actions/cache@v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
         with:
           path: |
             ${{ steps.go-cache.outputs.gomodcache }}
@@ -54,7 +54,7 @@ jobs:
         run: echo ${{ github.event.number }} > ./pr_number
       - name: Upload deltas
         if: matrix.os == 'ubicloud-standard-8'
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6
         with:
           name: delta-action-benchmarks
           retention-days: 7