diff --git a/.github/actions/restore-model-cache/action.yml b/.github/actions/restore-model-cache/action.yml
index ae5c122..0381625 100644
--- a/.github/actions/restore-model-cache/action.yml
+++ b/.github/actions/restore-model-cache/action.yml
@@ -49,7 +49,7 @@ runs:
   steps:
     - name: Restore model-weights cache
       id: cache
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ inputs.cache-path }}
         key: ${{ inputs.cache-key }}
diff --git a/.github/actions/setup-playwright/action.yml b/.github/actions/setup-playwright/action.yml
index 9fe63e1..1d0455a 100644
--- a/.github/actions/setup-playwright/action.yml
+++ b/.github/actions/setup-playwright/action.yml
@@ -40,7 +40,7 @@ runs:
   steps:
     - name: Restore Playwright browser cache
       id: cache
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ~/.cache/ms-playwright
         key: ${{ inputs.cache-key }}
diff --git a/.github/actions/setup-pnpm/action.yml b/.github/actions/setup-pnpm/action.yml
index a69368d..bac1436 100644
--- a/.github/actions/setup-pnpm/action.yml
+++ b/.github/actions/setup-pnpm/action.yml
@@ -62,7 +62,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6
+    - uses: pnpm/action-setup@0ebf47130e4866e96fce0953f49152a61190b271 # v6.0.9
       with:
         package_json_file: ${{ inputs.package-json-file }}
     - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
diff --git a/.github/workflows/python-gate.yml b/.github/workflows/python-gate.yml
index 5417160..4e1b10b 100644
--- a/.github/workflows/python-gate.yml
+++ b/.github/workflows/python-gate.yml
@@ -100,7 +100,7 @@ jobs:
 
       - name: Upload coverage to Codecov
         if: ${{ inputs.upload-coverage }}
-        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           files: ${{ inputs.working-directory }}/${{ inputs.coverage-file }}
           token: ${{ secrets.CODECOV_TOKEN }}
diff --git a/.github/workflows/secret-scan.yml b/.github/workflows/secret-scan.yml
index df9e2cb..ab8db4c 100644
--- a/.github/workflows/secret-scan.yml
+++ b/.github/workflows/secret-scan.yml
@@ -45,6 +45,6 @@ jobs:
         with:
           persist-credentials: false
           fetch-depth: 0 # full history — gitleaks scans every commit, not just HEAD
-      - uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3
+      - uses: gitleaks/gitleaks-action@e0c47f4f8be36e29cdc102c57e68cb5cbf0e8d1e # v3.0.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}