diff --git a/.github/workflows/build-oabctl.yml b/.github/workflows/build-oabctl.yml
index a0532ff0f..5e2c66b9c 100644
--- a/.github/workflows/build-oabctl.yml
+++ b/.github/workflows/build-oabctl.yml
@@ -63,7 +63,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable (2026-07-13)
         with:
           targets: ${{ matrix.target == 'linux-aarch64' && 'aarch64-unknown-linux-gnu' || '' }}
 
diff --git a/.github/workflows/build-operator.yml b/.github/workflows/build-operator.yml
index 19ec26a5e..95402a567 100644
--- a/.github/workflows/build-operator.yml
+++ b/.github/workflows/build-operator.yml
@@ -328,7 +328,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Install Helm
-        uses: azure/setup-helm@v4
+        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
 
       - uses: docker/login-action@v4
         with:
diff --git a/.github/workflows/bundle-pre-seed-utils.yml b/.github/workflows/bundle-pre-seed-utils.yml
index b73655d9b..2a97ca9e9 100644
--- a/.github/workflows/bundle-pre-seed-utils.yml
+++ b/.github/workflows/bundle-pre-seed-utils.yml
@@ -184,7 +184,7 @@ jobs:
       contents: read
     steps:
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4.3.1
         with:
           role-to-assume: ${{ secrets.AWS_ROLE_ARN }}
           aws-region: us-east-1
diff --git a/.github/workflows/chart-test.yml b/.github/workflows/chart-test.yml
index dddf67ce3..0a7f068ae 100644
--- a/.github/workflows/chart-test.yml
+++ b/.github/workflows/chart-test.yml
@@ -11,7 +11,7 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      - uses: azure/setup-helm@v4
+      - uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
         with:
           version: v3.18.5
 
diff --git a/.github/workflows/ci-agy-acp.yml b/.github/workflows/ci-agy-acp.yml
index 13d786061..c0f91de7f 100644
--- a/.github/workflows/ci-agy-acp.yml
+++ b/.github/workflows/ci-agy-acp.yml
@@ -16,7 +16,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable (2026-07-13)
 
       - name: Cache cargo
         uses: actions/cache@v4
diff --git a/.github/workflows/ci-auth-proxy.yml b/.github/workflows/ci-auth-proxy.yml
index 740b647c5..692571312 100644
--- a/.github/workflows/ci-auth-proxy.yml
+++ b/.github/workflows/ci-auth-proxy.yml
@@ -21,11 +21,11 @@ jobs:
     steps:
       - uses: actions/checkout@v6
 
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable (2026-07-13)
         with:
           components: clippy
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 (2026-03-12)
         with:
           workspaces: openab-auth-proxy
 
diff --git a/.github/workflows/ci-openab-agent.yml b/.github/workflows/ci-openab-agent.yml
index 28602942e..f25761d43 100644
--- a/.github/workflows/ci-openab-agent.yml
+++ b/.github/workflows/ci-openab-agent.yml
@@ -18,10 +18,10 @@ jobs:
         working-directory: openab-agent
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable (2026-07-13)
         with:
           components: rustfmt, clippy
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 (2026-03-12)
         with:
           workspaces: openab-agent
       # openab-agent is a standalone crate, not a member of the parent openab
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 908ff0145..53b5ea6f9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -38,10 +38,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable (2026-07-13)
         with:
           components: clippy
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 (2026-03-12)
       - name: cargo check
         run: cargo check --workspace
       - name: cargo clippy
@@ -63,10 +63,10 @@ jobs:
         working-directory: operator
     steps:
       - uses: actions/checkout@v6
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable (2026-07-13)
         with:
           components: clippy
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2 (2026-03-12)
         with:
           workspaces: operator
       - name: cargo check
diff --git a/.github/workflows/platform-schema-conformance.yml b/.github/workflows/platform-schema-conformance.yml
index 6f4a7f7d0..e2bd1795f 100644
--- a/.github/workflows/platform-schema-conformance.yml
+++ b/.github/workflows/platform-schema-conformance.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable (2026-07-13)
       # Standalone crate (serde + toml only); excluded from the root workspace
       # so it builds without the heavy adapter crates.
       # --locked: build strictly from the committed Cargo.lock; fail if it is
diff --git a/.github/workflows/pre-beta-build.yml b/.github/workflows/pre-beta-build.yml
index 1d1ae4d86..37d3559f9 100644
--- a/.github/workflows/pre-beta-build.yml
+++ b/.github/workflows/pre-beta-build.yml
@@ -88,7 +88,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable (2026-07-13)
 
       - name: Cache cargo registry & target
         uses: actions/cache@v4
@@ -261,7 +261,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@4be7066ada62dd38de10e7b70166bc74ed198c30 # stable (2026-07-13)
         with:
           targets: ${{ matrix.target == 'linux-aarch64' && 'aarch64-unknown-linux-gnu' || '' }}
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4867d97e5..ff8c0d993 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -26,10 +26,10 @@ jobs:
           git config user.email "$GITHUB_ACTOR@users.noreply.github.com"
 
       - name: Install Helm
-        uses: azure/setup-helm@v4
+        uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4 # v4.3.1
 
       - name: Run chart-releaser
-        uses: helm/chart-releaser-action@v1.6.0
+        uses: helm/chart-releaser-action@a917fd15b20e8b64b94d9158ad54cd6345335584 # v1.6.0
         with:
           skip_existing: true
         env: