diff --git a/.github/actions/checkout-with-stable-pkgs/action.yml b/.github/actions/checkout-with-stable-pkgs/action.yml
index d3afae7b2b6..23d83bab60d 100644
--- a/.github/actions/checkout-with-stable-pkgs/action.yml
+++ b/.github/actions/checkout-with-stable-pkgs/action.yml
@@ -7,7 +7,7 @@ runs:
   using: "composite"
   steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       with:
         fetch-depth: 0
         fetch-tags: true
diff --git a/.github/workflows/check-circular-deps.yml b/.github/workflows/check-circular-deps.yml
index e2830e96174..d92638990de 100644
--- a/.github/workflows/check-circular-deps.yml
+++ b/.github/workflows/check-circular-deps.yml
@@ -20,7 +20,7 @@ jobs:
     steps:
       # Checkout the branch of our repo that triggered this action
       - name: Workflow trigger checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Determine DAILY_BUILD_ID value
         run: |
diff --git a/.github/workflows/check-clean-stage.yml b/.github/workflows/check-clean-stage.yml
index d9a33db7f54..131580bb4c3 100644
--- a/.github/workflows/check-clean-stage.yml
+++ b/.github/workflows/check-clean-stage.yml
@@ -21,7 +21,7 @@ jobs:
     steps:
       # Checkout the branch of our repo that triggered this action
       - name: Workflow trigger checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Get base commit for PRs
         if: ${{ github.event_name == 'pull_request' }}
diff --git a/.github/workflows/check-entangled-specs.yml b/.github/workflows/check-entangled-specs.yml
index 0e566b911ac..05adfca1cff 100644
--- a/.github/workflows/check-entangled-specs.yml
+++ b/.github/workflows/check-entangled-specs.yml
@@ -23,11 +23,11 @@ jobs:
     steps:
       # Checkout the branch of our repo that triggered this action
       - name: Workflow trigger checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # For consistency, we use the same major/minor version of Python that Azure Linux ships
       - name: Setup Python 3.12
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: 3.12
 
diff --git a/.github/workflows/check-files.yml b/.github/workflows/check-files.yml
index 9393d91b77f..f1e10f1a815 100644
--- a/.github/workflows/check-files.yml
+++ b/.github/workflows/check-files.yml
@@ -20,7 +20,7 @@ jobs:
     steps:
 
     - name: Check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
     - name: Get base commit for PRs
       if: ${{ github.event_name == 'pull_request' }}
diff --git a/.github/workflows/check-kernel-configs.yml b/.github/workflows/check-kernel-configs.yml
index 4f7c016938a..755022f6cbf 100644
--- a/.github/workflows/check-kernel-configs.yml
+++ b/.github/workflows/check-kernel-configs.yml
@@ -26,7 +26,7 @@ jobs:
     steps:
       # Checkout the branch of our repo that triggered this action
       - name: Workflow trigger checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Get base commit for PRs
         if: ${{ github.event_name == 'pull_request' }}
@@ -44,7 +44,7 @@ jobs:
 
       # For consistency, we use the same major/minor version of Python that Azure Linux ships
       - name: Setup Python 3.12
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: 3.12
 
diff --git a/.github/workflows/check-license-map.yml b/.github/workflows/check-license-map.yml
index 172e053501e..ef836a705ec 100644
--- a/.github/workflows/check-license-map.yml
+++ b/.github/workflows/check-license-map.yml
@@ -22,10 +22,10 @@ jobs:
     steps:
       # Checkout the branch of our repo that triggered this action
       - name: Workflow trigger checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Setup Python 3.12
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: 3.12
 
diff --git a/.github/workflows/check-manifests.yml b/.github/workflows/check-manifests.yml
index 0bcd4705bed..3d7f027e08b 100644
--- a/.github/workflows/check-manifests.yml
+++ b/.github/workflows/check-manifests.yml
@@ -19,7 +19,7 @@ jobs:
     steps:
 
     - name: Check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
     # This PR runner uses an older Ubuntu with rpm version 4.17, which doesn't understand some newer macros like %bcond
     - name: Define missing rpm macros
diff --git a/.github/workflows/check-package-builds.yml b/.github/workflows/check-package-builds.yml
index ad8ee7ff449..3e075c6d30a 100644
--- a/.github/workflows/check-package-builds.yml
+++ b/.github/workflows/check-package-builds.yml
@@ -122,7 +122,7 @@ jobs:
               sed -i "/^%license/a %doc $license_file_name" "$REGULAR_PKG_SPEC_PATH"
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Checkout a stable version of the specs
         uses: ./.github/actions/checkout-with-stable-pkgs
diff --git a/.github/workflows/check-package-cgmanifest.yml b/.github/workflows/check-package-cgmanifest.yml
index 0190755c2e7..53bcb5c23ea 100644
--- a/.github/workflows/check-package-cgmanifest.yml
+++ b/.github/workflows/check-package-cgmanifest.yml
@@ -20,7 +20,7 @@ jobs:
     steps:
 
     - name: Check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
     # This PR runner uses an older Ubuntu with rpm version 4.17, which doesn't understand some newer macros like %bcond
     - name: Define missing rpm macros
diff --git a/.github/workflows/check-package-update-gate.yml b/.github/workflows/check-package-update-gate.yml
index d506a8b6b25..cb5e54f77bf 100644
--- a/.github/workflows/check-package-update-gate.yml
+++ b/.github/workflows/check-package-update-gate.yml
@@ -20,7 +20,7 @@ jobs:
     steps:
 
     - name: Check out code
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
     - name: Get base commit for PRs
       if: ${{ github.event_name == 'pull_request' }}
diff --git a/.github/workflows/check-source-signatures.yml b/.github/workflows/check-source-signatures.yml
index a35622792a7..5fa8a06d36b 100644
--- a/.github/workflows/check-source-signatures.yml
+++ b/.github/workflows/check-source-signatures.yml
@@ -23,11 +23,11 @@ jobs:
     steps:
       # Checkout the branch of our repo that triggered this action
       - name: Workflow trigger checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # For consistency, we use the same major/minor version of Python that Azure Linux ships
       - name: Setup Python 3.12
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: 3.12
 
diff --git a/.github/workflows/check-spec.yml b/.github/workflows/check-spec.yml
index 295eef4fdbc..6b8c82d8bef 100644
--- a/.github/workflows/check-spec.yml
+++ b/.github/workflows/check-spec.yml
@@ -20,11 +20,11 @@ jobs:
     steps:
       # Checkout the branch of our repo that triggered this action
       - name: Workflow trigger checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # For consistency, we use the same major/minor version of Python that Azure Linux ships
       - name: Setup Python 3.12
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: 3.12
 
@@ -57,7 +57,7 @@ jobs:
           echo "toolchain-spec-list=$(make --no-print-directory -sC toolkit printvar-toolchain_spec_list)" >> $GITHUB_ENV
 
       - name: Main branch checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: 'main'
           path: 'main-checkout'
diff --git a/.github/workflows/check-srpm-duplicates.yml b/.github/workflows/check-srpm-duplicates.yml
index f31cc6c8591..b5d6f2496a7 100644
--- a/.github/workflows/check-srpm-duplicates.yml
+++ b/.github/workflows/check-srpm-duplicates.yml
@@ -27,11 +27,11 @@ jobs:
     steps:
       # Checkout the branch of our repo that triggered this action
       - name: Workflow trigger checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # For consistency, we use the same major/minor version of Python that Azure Linux ships
       - name: Setup Python 3.12
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: 3.12
 
diff --git a/.github/workflows/check-static-glibc.yml b/.github/workflows/check-static-glibc.yml
index 536aeec60bb..9f918f299ae 100644
--- a/.github/workflows/check-static-glibc.yml
+++ b/.github/workflows/check-static-glibc.yml
@@ -21,11 +21,11 @@ jobs:
     steps:
       # Checkout the branch of our repo that triggered this action
       - name: Workflow trigger checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       # For consistency, we use the same major/minor version of Python that Azure Linux ships
       - name: Setup Python 3.12
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: 3.12
 
diff --git a/.github/workflows/go-test-coverage.yml b/.github/workflows/go-test-coverage.yml
index 1f61c34cf8f..8ed9c0314cd 100644
--- a/.github/workflows/go-test-coverage.yml
+++ b/.github/workflows/go-test-coverage.yml
@@ -22,7 +22,7 @@ jobs:
     steps:
 
     - name: Set up Go 1.x
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
       with:
         go-version: '${{ env.EXPECTED_GO_VERSION }}'
       id: go
@@ -32,7 +32,7 @@ jobs:
         go version && which go
 
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
     - name: Check go.mod
       run: |
@@ -89,7 +89,7 @@ jobs:
         sudo env "PATH=$PATH" make go-test-coverage
 
     - name: Upload test coverage
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: TestCoverage
         path: toolkit/out/tools/test_coverage_report.html
diff --git a/.github/workflows/lint-specs.yml b/.github/workflows/lint-specs.yml
index 7d0428888d5..b65cac32019 100644
--- a/.github/workflows/lint-specs.yml
+++ b/.github/workflows/lint-specs.yml
@@ -24,7 +24,7 @@ jobs:
     steps:
       # Checkout the branch of our repo that triggered this action
       - name: Workflow trigger checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Get base commit for PRs
         if: ${{ github.event_name == 'pull_request' }}
@@ -48,7 +48,7 @@ jobs:
           echo "updated-specs=$(echo ${changed_specs})" >> $GITHUB_ENV
 
       - name: Main branch checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: 'main'
           path: 'main-checkout'
@@ -56,7 +56,7 @@ jobs:
       # Our linter is based on the spec-cleaner tool from the folks at openSUSE
       # We apply a patch to modify it for Azure Linux's needs
       - name: spec-cleaner checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           repository: 'rpm-software-management/spec-cleaner'
           ref: 'spec-cleaner-1.2.0'
@@ -64,7 +64,7 @@ jobs:
 
       # For consistency, we use the same major/minor version of Python that Azure Linux ships
       - name: Setup Python 3.12
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: 3.12
 
@@ -98,7 +98,7 @@ jobs:
           fi
           exit 0
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         if: ${{ always() }}
         with:
           name: linted_specs
diff --git a/.github/workflows/merge-conflict-check.yml b/.github/workflows/merge-conflict-check.yml
index 01f0f44d183..8cdf99426c9 100644
--- a/.github/workflows/merge-conflict-check.yml
+++ b/.github/workflows/merge-conflict-check.yml
@@ -20,7 +20,7 @@ jobs:
     steps:
       # Checkout the branch of our repo that triggered this action
       - name: Workflow trigger checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Get base commit for PRs
         if: ${{ github.event_name == 'pull_request' }}
diff --git a/.github/workflows/quickstart_2.0.yml b/.github/workflows/quickstart_2.0.yml
index 9199e17e074..482df0c7994 100644
--- a/.github/workflows/quickstart_2.0.yml
+++ b/.github/workflows/quickstart_2.0.yml
@@ -19,12 +19,12 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       with:
         ref: '3.0-stable'
 
     - name: Set up Go 1.21
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
       with:
         go-version: 1.21
       id: go
@@ -67,12 +67,12 @@ jobs:
 
     steps:
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       with:
         ref: '3.0-stable'
 
     - name: Set up Go 1.21
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
       with:
         go-version: 1.21
       id: go
diff --git a/.github/workflows/verify-osguard-imageconfigs.yml b/.github/workflows/verify-osguard-imageconfigs.yml
index ce46a6a6e8b..0689a089c56 100644
--- a/.github/workflows/verify-osguard-imageconfigs.yml
+++ b/.github/workflows/verify-osguard-imageconfigs.yml
@@ -12,10 +12,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: '3.x'