diff --git a/.github/workflows/dependency_submission.yml b/.github/workflows/dependency_submission.yml
index b17e6af3..b7acfed2 100644
--- a/.github/workflows/dependency_submission.yml
+++ b/.github/workflows/dependency_submission.yml
@@ -14,7 +14,7 @@ jobs:
     name: "Report Mix Dependencies"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: erlef/mix-dependency-submission@v1
-      - uses: actions/dependency-review-action@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+      - uses: erlef/mix-dependency-submission@e182baa684c14cd34b84da828143cfc18a96c37e  # v1.3.2
+      - uses: actions/dependency-review-action@da24556b548a50705dd671f47852072ea4c105d9  # v4.7.1
         if: "${{ github.event_name == 'pull_request' }}"
diff --git a/.github/workflows/test_and_deploy.yml b/.github/workflows/test_and_deploy.yml
index d259c545..e630fe6f 100644
--- a/.github/workflows/test_and_deploy.yml
+++ b/.github/workflows/test_and_deploy.yml
@@ -16,8 +16,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
-      - uses: jdx/mise-action@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151  # v4
         with:
           experimental: true
       - name: Install Hex
@@ -33,7 +33,7 @@ jobs:
           FLUXON_LICENSE_KEY: ${{ secrets.FLUXON_LICENSE_KEY }}
           FLUXON_KEY_FINGERPRINT: ${{ secrets.FLUXON_KEY_FINGERPRINT }}
       - name: Cache deps
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5
         env:
           cache-name: cache-elixir-deps
         with:
@@ -42,7 +42,7 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-mix-${{ env.cache-name }}-${{ hashFiles('.tool-versions') }}-
       - name: Cache compiled build
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5
         env:
           cache-name: cache-compiled-build-lint
         with:
@@ -94,8 +94,8 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v6
-      - uses: jdx/mise-action@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151  # v4
         with:
           experimental: true
       - name: Install Hex
@@ -111,7 +111,7 @@ jobs:
           FLUXON_LICENSE_KEY: ${{ secrets.FLUXON_LICENSE_KEY }}
           FLUXON_KEY_FINGERPRINT: ${{ secrets.FLUXON_KEY_FINGERPRINT }}
       - name: Cache deps
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5
         env:
           cache-name: cache-elixir-deps
         with:
@@ -120,7 +120,7 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-mix-${{ env.cache-name }}-${{ hashFiles('.tool-versions') }}-
       - name: Cache compiled build
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # v5
         env:
           cache-name: cache-compiled-build-test
         with:
@@ -156,8 +156,8 @@ jobs:
     if: github.ref == 'refs/heads/main'
     concurrency: deploy-group
     steps:
-      - uses: actions/checkout@v6
-      - uses: gacts/install-hurl@v1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+      - uses: gacts/install-hurl@45ddf125aa95f3b3f2fc4a75c6625ce7739fec50  # v1
         with:
           version: 8.0.0
       - name: 🚀 Deploy to production
@@ -172,4 +172,4 @@ jobs:
         run: hurl --test --report-tap verification.tap test/prod.hurl
         env:
           HURL_VARIABLE_api_token: ${{ secrets.API_TOKEN }}
-      - uses: pcolby/tap-summary@v1
+      - uses: pcolby/tap-summary@ccdf184636a1a57277bbccbe3480bc021207e2d8  # v1
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index ccc25bd1..ca4c177a 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -7,9 +7,9 @@ jobs:
     runs-on: ubuntu-24.04
     environment: production
     steps:
-      - uses: actions/checkout@v6
-      - uses: gacts/install-hurl@v1
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6
+      - uses: gacts/install-hurl@45ddf125aa95f3b3f2fc4a75c6625ce7739fec50  # v1
       - run: hurl --test --report-tap verification.tap test/prod.hurl
         env:
           HURL_api_token: ${{ secrets.API_TOKEN }}
-      - uses: pcolby/tap-summary@v1
+      - uses: pcolby/tap-summary@ccdf184636a1a57277bbccbe3480bc021207e2d8  # v1