diff --git a/.github/workflows/48h-operativity.yml b/.github/workflows/48h-operativity.yml
index d8b535bf..89139b1a 100644
--- a/.github/workflows/48h-operativity.yml
+++ b/.github/workflows/48h-operativity.yml
@@ -24,7 +24,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Run 48h operativity checks
         id: operativity
@@ -70,7 +70,7 @@ jobs:
 
       - name: Upload operativity artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: operativity-48h-evidence
           path: |
@@ -82,7 +82,7 @@ jobs:
       - name: Resolve target PR number
         id: pr
         if: always()
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const owner = context.repo.owner;
@@ -107,7 +107,7 @@ jobs:
 
       - name: Comment PR with operativity summary
         if: ${{ always() && steps.pr.outputs.number != '' }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const owner = context.repo.owner;
diff --git a/.github/workflows/add-pr-comment.yml b/.github/workflows/add-pr-comment.yml
index a96e6a86..ccdae07b 100644
--- a/.github/workflows/add-pr-comment.yml
+++ b/.github/workflows/add-pr-comment.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Post PR check summary comment
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const run = context.payload.workflow_run;
diff --git a/.github/workflows/agent-sync-hardening.yml b/.github/workflows/agent-sync-hardening.yml
index 55315a62..ca0084a2 100644
--- a/.github/workflows/agent-sync-hardening.yml
+++ b/.github/workflows/agent-sync-hardening.yml
@@ -22,10 +22,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
 
@@ -59,13 +59,13 @@ jobs:
       PUSHGATEWAY_URL: ${{ secrets.PUSHGATEWAY_URL }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Generar metricas
         run: bash scripts/metrics-sync.sh > metrics.prom
 
       - name: Subir artefacto de metricas
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: agent-sync-metrics
           path: metrics.prom
@@ -82,7 +82,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Ejecutar chaos test seguro
         run: bash scripts/chaos-test-sync.sh
@@ -93,10 +93,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Descargar metricas
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: agent-sync-metrics
 
diff --git a/.github/workflows/ai-code-analysis.yml b/.github/workflows/ai-code-analysis.yml
index fe36f882..9fd0fa17 100644
--- a/.github/workflows/ai-code-analysis.yml
+++ b/.github/workflows/ai-code-analysis.yml
@@ -16,7 +16,7 @@ jobs:
     outputs:
       analysis: ${{ steps.claude-analysis.outputs.analysis }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
 
@@ -59,7 +59,7 @@ jobs:
     outputs:
       docs: ${{ steps.mistral-docs.outputs.docs }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Generate docs with Mistral
         id: mistral-docs
@@ -100,7 +100,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Post analysis comment
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const claudeAnalysis = `${{ needs.analyze-with-claude.outputs.analysis || 'No disponible' }}`;
diff --git a/.github/workflows/castuo-architecture-surface-check.yml b/.github/workflows/castuo-architecture-surface-check.yml
index 55f6a805..526472ac 100644
--- a/.github/workflows/castuo-architecture-surface-check.yml
+++ b/.github/workflows/castuo-architecture-surface-check.yml
@@ -13,7 +13,7 @@ jobs:
   surface-check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Reject tracked private key-like files
         shell: bash
         run: |
diff --git a/.github/workflows/cd-deploy.yml b/.github/workflows/cd-deploy.yml
index f3754c2e..2aed2170 100644
--- a/.github/workflows/cd-deploy.yml
+++ b/.github/workflows/cd-deploy.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Validate cloud config
         run: |
           cp .env.cloud.example .env.cloud
diff --git a/.github/workflows/ci-js.yml b/.github/workflows/ci-js.yml
index cb515e62..5e55f997 100644
--- a/.github/workflows/ci-js.yml
+++ b/.github/workflows/ci-js.yml
@@ -10,9 +10,9 @@ jobs:
   test-js:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '20'
           cache: 'npm'  # ⭐ Cache 80% más rápido
@@ -24,7 +24,7 @@ jobs:
         run: npm test --runInBand  # ⭐ Evita OOM en GitHub runners
       
       - name: Upload coverage
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: always()
         with:
           name: js-coverage
diff --git a/.github/workflows/ci-python.yml b/.github/workflows/ci-python.yml
index 64e64888..244a88d0 100644
--- a/.github/workflows/ci-python.yml
+++ b/.github/workflows/ci-python.yml
@@ -7,8 +7,8 @@ jobs:
   test-python:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.12'
       - name: Install deps
diff --git a/.github/workflows/data-timescaledb-ha.yml b/.github/workflows/data-timescaledb-ha.yml
index a7c5fa5b..8efda3a0 100644
--- a/.github/workflows/data-timescaledb-ha.yml
+++ b/.github/workflows/data-timescaledb-ha.yml
@@ -25,10 +25,10 @@ jobs:
           - 5432:5432
     
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.10'
       
diff --git a/.github/workflows/deploy-hetzner-staging.yml b/.github/workflows/deploy-hetzner-staging.yml
index 40cb35f3..71a9ee39 100644
--- a/.github/workflows/deploy-hetzner-staging.yml
+++ b/.github/workflows/deploy-hetzner-staging.yml
@@ -19,10 +19,10 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
 
@@ -43,7 +43,7 @@ jobs:
     if: github.ref == 'refs/heads/main' && vars.ENABLE_HETZNER_DEPLOY == 'true'
     steps:
       - name: Deploy with SSH
-        uses: appleboy/ssh-action@v1.0.3
+        uses: appleboy/ssh-action@029f5b4aeeeb58fdfe1410a5d17f967dacf36262 # v1.0.3
         with:
           host: ${{ secrets.HETZNER_STAGING_HOST }}
           username: ${{ secrets.HETZNER_STAGING_USER }}
diff --git a/.github/workflows/deploy-staging.yml b/.github/workflows/deploy-staging.yml
index 0ea2d624..ee95728c 100644
--- a/.github/workflows/deploy-staging.yml
+++ b/.github/workflows/deploy-staging.yml
@@ -29,7 +29,7 @@ jobs:
       contents: read
     environment: staging
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Validate docker-compose
         run: |
diff --git a/.github/workflows/deploy-to-hetzner.yml b/.github/workflows/deploy-to-hetzner.yml
index fbb97850..e8f1b139 100644
--- a/.github/workflows/deploy-to-hetzner.yml
+++ b/.github/workflows/deploy-to-hetzner.yml
@@ -19,10 +19,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
 
@@ -45,11 +45,11 @@ jobs:
       image_tag: ${{ steps.meta.outputs.version }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Docker meta
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
         with:
           images: registry.castuo-system.cloud/castuo-api
           tags: |
@@ -57,14 +57,14 @@ jobs:
             type=raw,value=latest
 
       - name: Login to registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: registry.castuo-system.cloud
           username: ${{ secrets.REGISTRY_USER }}
           password: ${{ secrets.REGISTRY_PASSWORD }}
 
       - name: Build and push
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5.4.0
         with:
           context: ./api
           push: true
@@ -79,10 +79,10 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Setup kubectl
-        uses: azure/setup-kubectl@v4
+        uses: azure/setup-kubectl@776406bce94f63e41d621b960d78ee25c8b76ede # v4.0.1
 
       - name: Configure kubeconfig
         run: |
diff --git a/.github/workflows/docker-image.yml b/.github/workflows/docker-image.yml
index 0b4b8e7c..ad07fadd 100644
--- a/.github/workflows/docker-image.yml
+++ b/.github/workflows/docker-image.yml
@@ -19,10 +19,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
           cache: pip
diff --git a/.github/workflows/docker-security.yml b/.github/workflows/docker-security.yml
index e253aef2..20af15ec 100644
--- a/.github/workflows/docker-security.yml
+++ b/.github/workflows/docker-security.yml
@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: Checkout código
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
 
@@ -161,7 +161,7 @@ jobs:
 
       - name: Subir artefactos de auditoría
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: docker-security-audit
           path: artifacts/docker-security/
@@ -169,7 +169,7 @@ jobs:
 
       - name: Comentar en PR (si existe)
         if: github.event_name == 'pull_request' && always()
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const fs = require('fs');
@@ -235,7 +235,7 @@ jobs:
 
     steps:
       - name: Checkout código
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Preparar scripts
         run: chmod +x scripts/docker-harden.sh scripts/docker-audit.sh
@@ -257,10 +257,10 @@ jobs:
 
     steps:
       - name: Checkout código
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Analizar capas de imágenes
         run: |
diff --git a/.github/workflows/e2e-first-commit.yml b/.github/workflows/e2e-first-commit.yml
index 0d10228f..d0f3d75f 100644
--- a/.github/workflows/e2e-first-commit.yml
+++ b/.github/workflows/e2e-first-commit.yml
@@ -25,7 +25,7 @@ jobs:
     if: ${{ github.actor != 'github-actions[bot]' }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
 
@@ -52,7 +52,7 @@ jobs:
           fi
 
       - name: Run Trivy filesystem scan
-        uses: aquasecurity/trivy-action@v0.20.0
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           scan-type: fs
           scan-ref: .
@@ -62,13 +62,13 @@ jobs:
       - name: Upload Trivy SARIF
         if: always()
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@1190a975f95ce23525efb6a3fc21ea29567c1b52 # v3.38.2
         with:
           sarif_file: trivy-results.sarif
 
       - name: Upload generated docs artifact
         if: ${{ steps.bootstrap.outputs.should_run == 'true' }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: quick-reference-main-bootstrap
           path: docs/QUICK-REFERENCE.md
diff --git a/.github/workflows/e2e-first-pr.yml b/.github/workflows/e2e-first-pr.yml
index 9ba36afd..3ef69814 100644
--- a/.github/workflows/e2e-first-pr.yml
+++ b/.github/workflows/e2e-first-pr.yml
@@ -18,15 +18,15 @@ jobs:
   validate-pr:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '20'
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.12'
 
@@ -63,7 +63,7 @@ jobs:
         run: ./scripts/generate-changelog.sh CHANGELOG.md
 
       - name: Upload changelog artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: changelog-pr-${{ github.event.pull_request.number }}
           path: CHANGELOG.md
diff --git a/.github/workflows/e2e-first-sale.yml b/.github/workflows/e2e-first-sale.yml
index 1a5f47be..bb83687a 100644
--- a/.github/workflows/e2e-first-sale.yml
+++ b/.github/workflows/e2e-first-sale.yml
@@ -98,7 +98,7 @@ jobs:
 
       - name: Upload artifacts
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: e2e-first-sale-artifacts
           path: |
diff --git a/.github/workflows/e2e-merge.yml b/.github/workflows/e2e-merge.yml
index 1822a28f..ae79dec2 100644
--- a/.github/workflows/e2e-merge.yml
+++ b/.github/workflows/e2e-merge.yml
@@ -25,12 +25,12 @@ jobs:
       SMTP_PASS: ${{ secrets.SMTP_PASS }}
       SMTP_PORT: ${{ secrets.SMTP_PORT }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: main
           fetch-depth: 0
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.12'
 
@@ -99,7 +99,7 @@ jobs:
           fi
 
       - name: Upload release note artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: merge-release-notes-${{ github.run_number }}
           path: |
@@ -119,7 +119,7 @@ jobs:
 
       - name: Notify by email
         if: ${{ env.SMTP_SERVER != '' && env.SMTP_USER != '' && env.SMTP_PASS != '' }}
-        uses: dawidd6/action-send-mail@v3
+        uses: dawidd6/action-send-mail@4226df7daafa6fc901a43789c49bf7ab309066e7 # v3.11.0
         with:
           server_address: ${{ env.SMTP_SERVER }}
           server_port: ${{ env.SMTP_PORT || '587' }}
diff --git a/.github/workflows/e2e-release.yml b/.github/workflows/e2e-release.yml
index 051cf54d..4c9c0cc6 100644
--- a/.github/workflows/e2e-release.yml
+++ b/.github/workflows/e2e-release.yml
@@ -27,12 +27,12 @@ jobs:
       SMTP_PASS: ${{ secrets.SMTP_PASS }}
       SMTP_PORT: ${{ secrets.SMTP_PORT }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: main
           fetch-depth: 0
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.12'
 
@@ -58,7 +58,7 @@ jobs:
 
       - name: Deploy to production over SSH
         if: ${{ env.HETZNER_PROD_HOST != '' && env.HETZNER_PROD_USER != '' && env.HETZNER_PROD_SSH_KEY != '' && env.HETZNER_PROD_APP_DIR != '' }}
-        uses: appleboy/ssh-action@v1.0.3
+        uses: appleboy/ssh-action@029f5b4aeeeb58fdfe1410a5d17f967dacf36262 # v1.0.3
         with:
           host: ${{ env.HETZNER_PROD_HOST }}
           username: ${{ env.HETZNER_PROD_USER }}
@@ -101,7 +101,7 @@ jobs:
           fi
 
       - name: Upload PDF to release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
         with:
           tag_name: ${{ github.event.release.tag_name }}
           files: release-notes-${{ github.event.release.tag_name }}.pdf
@@ -115,7 +115,7 @@ jobs:
 
       - name: Notify board by email
         if: ${{ env.SMTP_SERVER != '' && env.SMTP_USER != '' && env.SMTP_PASS != '' }}
-        uses: dawidd6/action-send-mail@v3
+        uses: dawidd6/action-send-mail@4226df7daafa6fc901a43789c49bf7ab309066e7 # v3.11.0
         with:
           server_address: ${{ env.SMTP_SERVER }}
           server_port: ${{ env.SMTP_PORT || '587' }}
diff --git a/.github/workflows/e2e-smoke-traces.yml b/.github/workflows/e2e-smoke-traces.yml
index 674911b7..390dd0c0 100644
--- a/.github/workflows/e2e-smoke-traces.yml
+++ b/.github/workflows/e2e-smoke-traces.yml
@@ -26,10 +26,10 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.11"
 
diff --git a/.github/workflows/generate-visual-summary.yml b/.github/workflows/generate-visual-summary.yml
index 13da4c16..cbbe24c2 100644
--- a/.github/workflows/generate-visual-summary.yml
+++ b/.github/workflows/generate-visual-summary.yml
@@ -12,12 +12,12 @@ jobs:
   generate-summary:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: main
           fetch-depth: 0
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.12'
 
@@ -44,7 +44,7 @@ jobs:
           fi
 
       - name: Upload visual artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: visual-summary-${{ github.run_number }}
           path: |
diff --git a/.github/workflows/github-operativity-certification.yml b/.github/workflows/github-operativity-certification.yml
index dfe8736a..98fdcc9b 100644
--- a/.github/workflows/github-operativity-certification.yml
+++ b/.github/workflows/github-operativity-certification.yml
@@ -43,10 +43,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Setup Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
           cache: "pip"
@@ -96,7 +96,7 @@ jobs:
 
       - name: Upload operativity evidence
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: github-operativity-evidence
           path: artifacts/operativity/github-operativity-latest.txt
diff --git a/.github/workflows/notify-workflow-failure.yml b/.github/workflows/notify-workflow-failure.yml
index c23ed7c6..6c77d3eb 100644
--- a/.github/workflows/notify-workflow-failure.yml
+++ b/.github/workflows/notify-workflow-failure.yml
@@ -39,7 +39,7 @@ jobs:
 
       - name: Comment on PR when available
         if: ${{ github.event.workflow_run.event == 'pull_request' }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const run = context.payload.workflow_run;
diff --git a/.github/workflows/reconcile-ci.yml b/.github/workflows/reconcile-ci.yml
index 92a0b4b5..55cf6c6e 100644
--- a/.github/workflows/reconcile-ci.yml
+++ b/.github/workflows/reconcile-ci.yml
@@ -18,7 +18,7 @@ jobs:
     env:
       SABIONDA_API_KEY: ${{ secrets.SABIONDA_API_KEY }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 0
 
@@ -76,7 +76,7 @@ jobs:
           fi
 
       - name: Subir artefactos
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: always()
         with:
           name: reconcile-artifacts
diff --git a/.github/workflows/sabionda-sync.yml b/.github/workflows/sabionda-sync.yml
index dff78f00..14176843 100644
--- a/.github/workflows/sabionda-sync.yml
+++ b/.github/workflows/sabionda-sync.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event_name == 'push'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Notify SABIONDA webhook
         env:
diff --git a/.github/workflows/satellite-ci.yml b/.github/workflows/satellite-ci.yml
index c4b7010a..c6f05bc7 100644
--- a/.github/workflows/satellite-ci.yml
+++ b/.github/workflows/satellite-ci.yml
@@ -14,10 +14,10 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "3.12"
 
@@ -36,7 +36,7 @@ jobs:
     needs: test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Install kubeconform
         run: |
diff --git a/.github/workflows/security-jwt.yml b/.github/workflows/security-jwt.yml
index b800a640..58c24011 100644
--- a/.github/workflows/security-jwt.yml
+++ b/.github/workflows/security-jwt.yml
@@ -5,10 +5,10 @@ jobs:
   jwt-validation:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.10'
       
diff --git a/.github/workflows/security-mfa.yml b/.github/workflows/security-mfa.yml
index ef1c9b09..6d9d54bd 100644
--- a/.github/workflows/security-mfa.yml
+++ b/.github/workflows/security-mfa.yml
@@ -5,10 +5,10 @@ jobs:
   mfa-setup:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.10'
       
@@ -36,7 +36,7 @@ jobs:
           "
       
       - name: Scan for exposed secrets
-        uses: trufflesecurity/trufflehog@v3.63.2
+        uses: trufflesecurity/trufflehog@11394ea318a12a5bf99c1b0cb7ba5e44b3c7a79c # v3.63.2
         with:
           path: ./
           base: ${{ github.event.repository.default_branch }}
diff --git a/.github/workflows/security-rate-limiting.yml b/.github/workflows/security-rate-limiting.yml
index 2cac72f4..ce187c60 100644
--- a/.github/workflows/security-rate-limiting.yml
+++ b/.github/workflows/security-rate-limiting.yml
@@ -16,10 +16,10 @@ jobs:
           - 6379:6379
     
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.10'
       
diff --git a/.github/workflows/security-sql-injection.yml b/.github/workflows/security-sql-injection.yml
index f2b9469c..52eb9fa3 100644
--- a/.github/workflows/security-sql-injection.yml
+++ b/.github/workflows/security-sql-injection.yml
@@ -5,7 +5,7 @@ jobs:
   sql-injection-scan:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Validate ORM usage and scan SQL injection risk
         continue-on-error: true
         run: |
diff --git a/.github/workflows/thingsdata-integration.yml b/.github/workflows/thingsdata-integration.yml
index e6772a0c..716a0483 100644
--- a/.github/workflows/thingsdata-integration.yml
+++ b/.github/workflows/thingsdata-integration.yml
@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Validate JSON configurations
         run: |
@@ -56,10 +56,10 @@ jobs:
     runs-on: ubuntu-latest
     needs: validate-thingsdata-config
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Build Thingsdata services
         run: |
@@ -86,7 +86,7 @@ jobs:
     needs: build-thingsdata-stack
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Start IoT stack (docker-compose)
         run: |
@@ -201,10 +201,10 @@ jobs:
     runs-on: ubuntu-latest
     needs: validate-thingsdata-config
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Run Trivy image scan
-        uses: aquasecurity/trivy-action@v0.35.0
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           scan-type: 'config'
           scan-ref: 'infrastructure/thingsdata'
@@ -213,7 +213,7 @@ jobs:
           severity: 'CRITICAL,HIGH'
 
       - name: Upload Trivy results to GitHub Security
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@1190a975f95ce23525efb6a3fc21ea29567c1b52 # v3.38.2
         if: always()
         continue-on-error: true
         with:
@@ -236,7 +236,7 @@ jobs:
     name: Compliance Check (RGPD/eIDAS/NIS2)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Verify GDPR compliance configuration
         run: |
@@ -273,7 +273,7 @@ jobs:
     needs: [integration-test-thingsdata, compliance-check]
     environment: staging
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Deploy to Hetzner Cloud (staging)
         env:
@@ -305,7 +305,7 @@ jobs:
 
       - name: Send Slack notification (optional)
         if: ${{ github.event_name == 'push' && env.SLACK_WEBHOOK_URL != '' }}
-        uses: slackapi/slack-github-action@v1.27.0
+        uses: slackapi/slack-github-action@37ebaef184d7626c5f204ab8d3baff4262dd30f0 # v1.27.0
         with:
           payload: |
             {
diff --git a/.github/workflows/validate-all.yml b/.github/workflows/validate-all.yml
index d232cb07..e92c5e6e 100644
--- a/.github/workflows/validate-all.yml
+++ b/.github/workflows/validate-all.yml
@@ -18,7 +18,7 @@ jobs:
   validate-docs:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Validate documentation
         run: |
           chmod +x scripts/validate-docs.sh
@@ -27,14 +27,14 @@ jobs:
   validate-tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '20'
           cache: 'npm'
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.12'
           cache: 'pip'
@@ -67,7 +67,7 @@ jobs:
 
       - name: Upload coverage artifact
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: coverage-report
           path: artifacts/coverage.xml
@@ -83,9 +83,9 @@ jobs:
   validate-security:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Trivy filesystem scan
-        uses: aquasecurity/trivy-action@v0.35.0
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           scan-type: fs
           scan-ref: .
@@ -94,7 +94,7 @@ jobs:
       - name: Upload Trivy SARIF
         if: always()
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@1190a975f95ce23525efb6a3fc21ea29567c1b52 # v3.38.2
         with:
           sarif_file: trivy-results.sarif
 
@@ -103,7 +103,7 @@ jobs:
     runs-on: ubuntu-latest
     needs: [validate-docs, validate-tests, validate-security]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Notify Slack on failure only
         env:
           SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
diff --git a/.github/workflows/vault-integration.yml b/.github/workflows/vault-integration.yml
index 1dc1f14e..17f73fe3 100644
--- a/.github/workflows/vault-integration.yml
+++ b/.github/workflows/vault-integration.yml
@@ -13,7 +13,7 @@ jobs:
   validate-vault-pattern:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Validate secrets files pattern
         run: |
           grep -R "_FILE" -n docker-compose.cloud.yml .env.cloud.example >/dev/null
diff --git a/scripts/goldfish-execute.sh b/scripts/goldfish-execute.sh
index 39965424..be983b90 100755
--- a/scripts/goldfish-execute.sh
+++ b/scripts/goldfish-execute.sh
@@ -64,7 +64,7 @@ jobs:
   sql-injection-scan:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       - name: Run Trivy for SQL injection patterns
         run: |
           docker run --rm -v $PWD:/workspace \
@@ -488,10 +488,10 @@ jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       
       - name: Set up Python
-        uses: actions/setup-python@v4
+        uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4.9.1
         with:
           python-version: '3.10'
       
@@ -508,7 +508,7 @@ jobs:
         run: flake8 api/ --count --select=E9,F63,F7,F82 --show-source
       
       - name: Security scan with Trivy
-        uses: aquasecurity/trivy-action@master
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           scan-type: 'config'
           scan-ref: '.'
@@ -517,7 +517,7 @@ jobs:
       
       - name: Comment on PR
         if: always()
-        uses: actions/github-script@v6
+        uses: actions/github-script@d7906e4ad0b1822421a7e6a35d5ca353c962f410 # v6.4.1
         with:
           script: |
             github.rest.issues.createComment({