diff --git a/.github/workflows/block_major_releases.yml b/.github/workflows/block_major_releases.yml
index 3f69bcff5bc..59696502cbf 100644
--- a/.github/workflows/block_major_releases.yml
+++ b/.github/workflows/block_major_releases.yml
@@ -15,7 +15,7 @@ jobs:
       pull-requests: read
     steps:
       - name: Enforce Multiple Approvals for Major Releases
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           script: |
             const prTitle = context.payload.pull_request.title;
diff --git a/.github/workflows/google-contributor-stale.yml b/.github/workflows/google-contributor-stale.yml
index 4f1e7d4372c..d4c14677d87 100644
--- a/.github/workflows/google-contributor-stale.yml
+++ b/.github/workflows/google-contributor-stale.yml
@@ -14,7 +14,7 @@ jobs:
       issues: write
 
     steps:
-      - uses: actions/stale@v10
+      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           any-of-labels: "google-contributor"
@@ -26,4 +26,4 @@ jobs:
           close-pr-message: >
             This google-contributor PR has been inactive for 14 days.
           days-before-issue-stale: -1
-          days-before-issue-close: -1
\ No newline at end of file
+          days-before-issue-close: -1
diff --git a/.github/workflows/pre-release-tests.yml b/.github/workflows/pre-release-tests.yml
index 2325863da39..d236adb845d 100644
--- a/.github/workflows/pre-release-tests.yml
+++ b/.github/workflows/pre-release-tests.yml
@@ -7,14 +7,18 @@ on:
   push:
     branches:
       - main
+permissions:
+  contents: read
 
 jobs:
   build:
     runs-on: ubuntu-latest
     if: github.ref_name == 'release-please--branches--main' || github.head_ref == 'release-please--branches--main'
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-java@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4
       with:
         distribution: 'temurin'
         java-version: '21'
@@ -24,4 +28,4 @@ jobs:
     - name: Compile Examples
       run: mvn -B -ntp compile -f examples/pom.xml
     - name: Generate Javadoc
-      run: mvn -B -ntp package -DperformRelease=true -DskipTests -Djacoco.skip=true -Dclirr.skip=true
\ No newline at end of file
+      run: mvn -B -ntp package -DperformRelease=true -DskipTests -Djacoco.skip=true -Dclirr.skip=true
diff --git a/.github/workflows/publish-javadoc.yml b/.github/workflows/publish-javadoc.yml
index dffee016359..3e94b948a0e 100644
--- a/.github/workflows/publish-javadoc.yml
+++ b/.github/workflows/publish-javadoc.yml
@@ -17,10 +17,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
 
       - name: Set up JDK 17
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4
         with:
           java-version: '17'
           distribution: 'temurin'
@@ -33,9 +35,9 @@ jobs:
       # 2. Deploy ONLY when merging/pushing to main
       - name: Deploy JavaDoc 🚀
         if: github.event_name == 'push' && github.ref == 'refs/heads/main'
-        uses: MathieuSoysal/Javadoc-publisher.yml@v3.0.2
+        uses: MathieuSoysal/Javadoc-publisher.yml@fda475b197081ba1eca7a1dfadf0c017080a1623 # v3.0.2
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           javadoc-branch: gh-pages
           java-version: 17
-          target-folder: javadoc
\ No newline at end of file
+          target-folder: javadoc
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index dff9b18fcd3..876c52c741a 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -16,7 +16,7 @@ jobs:
       pull-requests: write
 
     steps:
-    - uses: actions/stale@v10
+    - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         days-before-issue-stale: 7
diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
index d2fd993b39c..e998299ae9b 100644
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@@ -7,6 +7,8 @@ on:
   push:
     branches:
       - main
+permissions:
+  contents: read
 
 jobs:
   unit-test:
@@ -19,11 +21,13 @@ jobs:
       fail-fast: false
     name: unit-test (${{matrix.java}})
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-java@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      with:
+        persist-credentials: false
+    - uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4
       with:
         distribution: 'temurin'
         java-version: ${{matrix.java}}
         cache: 'maven'
     - name: Java Unit Tests
-      run: mvn clean test -Dtest=${{matrix.testgroup}} -Djacoco.skip=true
\ No newline at end of file
+      run: mvn clean test -Dtest=${{matrix.testgroup}} -Djacoco.skip=true