diff --git a/.github/workflows/claude_code_review.yml b/.github/workflows/claude_code_review.yml
index 893e882c3..1426ff49f 100644
--- a/.github/workflows/claude_code_review.yml
+++ b/.github/workflows/claude_code_review.yml
@@ -337,7 +337,7 @@ jobs:
       # review script (lets a workflow/script change self-test on its own PR).
       # Secrets are withheld from fork-PR runs and pre-checks gate the rest.
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 1
@@ -447,7 +447,7 @@ jobs:
       # which doesn't exist in the base repo, so checkout exited 1 (.github#111).
       - name: Checkout base repo (trusted review script)
         if: steps.auth.outputs.authorized == 'true' && steps.pr.outputs.is_pr == 'true'
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 1
@@ -503,7 +503,7 @@ jobs:
       # request 403s without it.
       pull-requests: read
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 1
diff --git a/.github/workflows/client-python-ci.yml b/.github/workflows/client-python-ci.yml
index 16f79b17b..b10ef905e 100644
--- a/.github/workflows/client-python-ci.yml
+++ b/.github/workflows/client-python-ci.yml
@@ -18,10 +18,10 @@ jobs:
       run:
         working-directory: clients/python
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
       - name: Install
diff --git a/.github/workflows/client-typescript-ci.yml b/.github/workflows/client-typescript-ci.yml
index a5e47a023..c2cae415d 100644
--- a/.github/workflows/client-typescript-ci.yml
+++ b/.github/workflows/client-typescript-ci.yml
@@ -18,10 +18,10 @@ jobs:
       run:
         working-directory: clients/typescript
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "20"
       - name: Install
diff --git a/.github/workflows/publish-npm-caura-client.yml b/.github/workflows/publish-npm-caura-client.yml
index 3e6fd40ca..655892ab6 100644
--- a/.github/workflows/publish-npm-caura-client.yml
+++ b/.github/workflows/publish-npm-caura-client.yml
@@ -45,10 +45,10 @@ jobs:
       run:
         working-directory: clients/npm-caura-client
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "20"
           registry-url: "https://registry.npmjs.org"
diff --git a/.github/workflows/publish-npm-caura-sdk.yml b/.github/workflows/publish-npm-caura-sdk.yml
index 323173486..81287e9f5 100644
--- a/.github/workflows/publish-npm-caura-sdk.yml
+++ b/.github/workflows/publish-npm-caura-sdk.yml
@@ -45,10 +45,10 @@ jobs:
       run:
         working-directory: clients/npm-caura-sdk
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "20"
           registry-url: "https://registry.npmjs.org"
diff --git a/.github/workflows/publish-npm-client.yml b/.github/workflows/publish-npm-client.yml
index e873022d8..7d552c241 100644
--- a/.github/workflows/publish-npm-client.yml
+++ b/.github/workflows/publish-npm-client.yml
@@ -45,10 +45,10 @@ jobs:
       run:
         working-directory: clients/typescript
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "20"
           registry-url: "https://registry.npmjs.org"
diff --git a/.github/workflows/publish-npm-sdk.yml b/.github/workflows/publish-npm-sdk.yml
index f866963d2..0cf1d4880 100644
--- a/.github/workflows/publish-npm-sdk.yml
+++ b/.github/workflows/publish-npm-sdk.yml
@@ -45,10 +45,10 @@ jobs:
       run:
         working-directory: clients/npm-sdk
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "20"
           registry-url: "https://registry.npmjs.org"
diff --git a/.github/workflows/publish-python-client.yml b/.github/workflows/publish-python-client.yml
index 56ce51335..be917ab63 100644
--- a/.github/workflows/publish-python-client.yml
+++ b/.github/workflows/publish-python-client.yml
@@ -46,10 +46,10 @@ jobs:
             exit 1
           fi
           echo "OIDC token-request context is present"
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
       # A tag that disagrees with pyproject.toml does not fail — it publishes
diff --git a/.github/workflows/publish-python-metapackage.yml b/.github/workflows/publish-python-metapackage.yml
index d61d865b2..a717420e4 100644
--- a/.github/workflows/publish-python-metapackage.yml
+++ b/.github/workflows/publish-python-metapackage.yml
@@ -47,10 +47,10 @@ jobs:
             exit 1
           fi
           echo "OIDC token-request context is present"
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
       # This package was created under the Caura name and has no legacy tag
diff --git a/.github/workflows/publish-python-sdk.yml b/.github/workflows/publish-python-sdk.yml
index 0bb7bbec3..a7140f34e 100644
--- a/.github/workflows/publish-python-sdk.yml
+++ b/.github/workflows/publish-python-sdk.yml
@@ -50,10 +50,10 @@ jobs:
             exit 1
           fi
           echo "OIDC token-request context is present"
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.12"
       # This package was created under the Caura name and has no legacy tag
diff --git a/.github/workflows/verify-npm-credential.yml b/.github/workflows/verify-npm-credential.yml
index bac7f78e7..1d3286adb 100644
--- a/.github/workflows/verify-npm-credential.yml
+++ b/.github/workflows/verify-npm-credential.yml
@@ -44,10 +44,10 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "20"
           registry-url: "https://registry.npmjs.org"