diff --git a/.github/workflows/apply-required-checks.yml b/.github/workflows/apply-required-checks.yml
index af91b8bc6d..a80186e75d 100644
--- a/.github/workflows/apply-required-checks.yml
+++ b/.github/workflows/apply-required-checks.yml
@@ -69,7 +69,7 @@ jobs:
     name: Apply required E2E status checks (C6)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Preview checks (dry run)
         if: github.event_name == 'workflow_dispatch' && github.event.inputs.confirm != 'APPLY'
diff --git a/.github/workflows/auth-bootstrap-guard.yml b/.github/workflows/auth-bootstrap-guard.yml
index 45f8f11bb1..bd2411861b 100644
--- a/.github/workflows/auth-bootstrap-guard.yml
+++ b/.github/workflows/auth-bootstrap-guard.yml
@@ -25,13 +25,13 @@ jobs:
       CLAWMETRY_HARD_BLOCK: '0'
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "20"
 
diff --git a/.github/workflows/auto-quarantine.yml b/.github/workflows/auto-quarantine.yml
index 3e438f48f4..bedbb3b181 100644
--- a/.github/workflows/auto-quarantine.yml
+++ b/.github/workflows/auto-quarantine.yml
@@ -36,11 +36,11 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
 
diff --git a/.github/workflows/c6-pr-gate.yml b/.github/workflows/c6-pr-gate.yml
index fc1be1e19b..8ded3a5ed5 100644
--- a/.github/workflows/c6-pr-gate.yml
+++ b/.github/workflows/c6-pr-gate.yml
@@ -64,7 +64,7 @@ jobs:
     timeout-minutes: 2
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Read-only audit: verify clawmetry/main has the required E2E status
       # checks configured. The script detects the ghs_ GITHUB_TOKEN prefix,
diff --git a/.github/workflows/c6-schedule-heal.yml b/.github/workflows/c6-schedule-heal.yml
index a03a671d21..9d264f4f91 100644
--- a/.github/workflows/c6-schedule-heal.yml
+++ b/.github/workflows/c6-schedule-heal.yml
@@ -91,7 +91,7 @@ jobs:
     # was added. See PR #4553.
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Check for admin token
         id: pat-check
diff --git a/.github/workflows/e2e-gate.yml b/.github/workflows/e2e-gate.yml
index bb27595db0..61127bc7fd 100644
--- a/.github/workflows/e2e-gate.yml
+++ b/.github/workflows/e2e-gate.yml
@@ -51,7 +51,7 @@ jobs:
       # checkout while the logic was an inline heredoc, which needs nothing
       # from the working tree -- converting it to a script call silently broke
       # that assumption and the gate died with "No such file or directory".
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # The gate logic lives in scripts/e2e_gate.py so it can be unit-tested
       # (tests/test_e2e_gate.py) instead of only being exercised in anger on a
diff --git a/.github/workflows/harness-observability-audit.yml b/.github/workflows/harness-observability-audit.yml
index 1e027fb9e6..92c1164608 100644
--- a/.github/workflows/harness-observability-audit.yml
+++ b/.github/workflows/harness-observability-audit.yml
@@ -46,13 +46,13 @@ jobs:
       HARNESS_DIR: ${{ github.workspace }}/.harness
     steps:
       - name: Checkout clawmetry (OSS)
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "22"
 
diff --git a/.github/workflows/product-record-gate.yml b/.github/workflows/product-record-gate.yml
index 8594fc8712..6e27cbc9d4 100644
--- a/.github/workflows/product-record-gate.yml
+++ b/.github/workflows/product-record-gate.yml
@@ -28,11 +28,11 @@ jobs:
     name: PR cites the product record that justified it
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
 
diff --git a/.github/workflows/quarantine-sweep.yml b/.github/workflows/quarantine-sweep.yml
index 1fba1bda77..54a8ba0273 100644
--- a/.github/workflows/quarantine-sweep.yml
+++ b/.github/workflows/quarantine-sweep.yml
@@ -33,9 +33,9 @@ jobs:
     continue-on-error: true
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
 
@@ -127,7 +127,7 @@ jobs:
 
       - name: Upload sweep logs
         if: always() && steps.check.outputs.count != '0'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: quarantine-sweep-logs-${{ github.run_number }}
           path: |