diff --git a/.github/workflows/browserstack.yml b/.github/workflows/browserstack.yml
index 792c41ab2c..4f5ca625fa 100644
--- a/.github/workflows/browserstack.yml
+++ b/.github/workflows/browserstack.yml
@@ -20,9 +20,9 @@ jobs:
     timeout-minutes: 15
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: "3.11"
 
@@ -41,13 +41,13 @@ jobs:
           done
 
       - name: Set up BrowserStack env
-        uses: browserstack/github-actions/setup-env@master
+        uses: browserstack/github-actions/setup-env@1ab56d9521ce20f4651bb5d9f3ef39c5ba54805a # master @ 2026-08-28
         with:
           username: ${{ secrets.BROWSERSTACK_USERNAME }}
           access-key: ${{ secrets.BROWSERSTACK_ACCESS_KEY }}
 
       - name: Start BrowserStack Local Tunnel
-        uses: browserstack/github-actions/setup-local@master
+        uses: browserstack/github-actions/setup-local@1ab56d9521ce20f4651bb5d9f3ef39c5ba54805a # master @ 2026-08-28
         with:
           local-testing: start
           local-identifier: clawmetry-${{ github.run_id }}
@@ -64,7 +64,7 @@ jobs:
 
       - name: Stop BrowserStack Local Tunnel
         if: always()
-        uses: browserstack/github-actions/setup-local@master
+        uses: browserstack/github-actions/setup-local@1ab56d9521ce20f4651bb5d9f3ef39c5ba54805a # master @ 2026-08-28
         with:
           local-testing: stop
           local-identifier: clawmetry-${{ github.run_id }}
diff --git a/.github/workflows/i18n-autotranslate.yml b/.github/workflows/i18n-autotranslate.yml
index 7a40f20da5..7014e81242 100644
--- a/.github/workflows/i18n-autotranslate.yml
+++ b/.github/workflows/i18n-autotranslate.yml
@@ -31,7 +31,7 @@ jobs:
       # Claude Code subscription token (from `claude setup-token`), NOT an Anthropic API key.
       CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 2  # need the previous en.json to detect CHANGED keys
 
@@ -42,7 +42,7 @@ jobs:
             echo "SKIP=1" >> "$GITHUB_ENV"
           fi
 
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         if: env.SKIP != '1'
         with:
           python-version: '3.11'
@@ -68,7 +68,7 @@ jobs:
 
       - name: Open sync PR
         if: env.SKIP != '1'
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           branch: chore/i18n-autotranslate
           delete-branch: true
diff --git a/.github/workflows/i18n-docs-autotranslate.yml b/.github/workflows/i18n-docs-autotranslate.yml
index 430fb571fb..6283c60a3b 100644
--- a/.github/workflows/i18n-docs-autotranslate.yml
+++ b/.github/workflows/i18n-docs-autotranslate.yml
@@ -27,7 +27,7 @@ jobs:
     env:
       CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Guard - require Claude Code token
         run: |
@@ -36,7 +36,7 @@ jobs:
             echo "SKIP=1" >> "$GITHUB_ENV"
           fi
 
-      - uses: actions/setup-python@v7
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         if: env.SKIP != '1'
         with:
           python-version: '3.11'
@@ -61,7 +61,7 @@ jobs:
 
       - name: Open sync PR
         if: env.SKIP != '1'
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           branch: chore/i18n-docs-autotranslate
           delete-branch: true
diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml
index 4ffd759813..351cce0040 100644
--- a/.github/workflows/supply-chain.yml
+++ b/.github/workflows/supply-chain.yml
@@ -157,6 +157,6 @@ jobs:
           path: scorecard-results.sarif
           retention-days: 30
       # Surfaces findings in the GitHub Security tab rather than only in logs.
-      - uses: github/codeql-action/upload-sarif@v3
+      - uses: github/codeql-action/upload-sarif@6f5948dfacef28e207b48d0905cf90c03365536d # v3.37.9
         with:
           sarif_file: scorecard-results.sarif