diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index c3bbdc74..1c8e43dc 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -16,9 +16,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Cache Go Modules
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.cache/go-build
@@ -26,19 +26,19 @@ jobs:
           key: ${{ runner.os }}-gomod-ci-${{ hashFiles('gradle.properties', 'gradle/libs.versions.toml') }}
           restore-keys:
             ${{ runner.os }}-gomod-ci-
-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
         with:
           distribution: 'temurin'
           java-version: '21'
           cache: 'gradle'
-      - uses: bufbuild/buf-action@v1
+      - uses: bufbuild/buf-action@8f4a1456a0ab6a1eb80ba68e53832e6fcfacc16c # v1.3.0
         with:
           setup_only: true
       - env:
           BUF_TOKEN: ${{ secrets.BUF_TOKEN }}
         run: echo ${BUF_TOKEN} | buf registry login buf.build --token-stdin
       - name: Validate Gradle Wrapper
-        uses: gradle/actions/wrapper-validation@v5
+        uses: gradle/actions/wrapper-validation@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
       - name: Lint
         run: make lint
       - name: Generate
diff --git a/.github/workflows/conformance.yaml b/.github/workflows/conformance.yaml
index bec4c4c0..5ddec17e 100644
--- a/.github/workflows/conformance.yaml
+++ b/.github/workflows/conformance.yaml
@@ -16,9 +16,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Cache Go Modules
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.cache/go-build
@@ -26,18 +26,18 @@ jobs:
           key: ${{ runner.os }}-gomod-conformance-${{ hashFiles('gradle.properties', 'gradle/libs.versions.toml') }}
           restore-keys:
             ${{ runner.os }}-gomod-conformance-
-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
         with:
           distribution: 'temurin'
           java-version: '21'
           cache: 'gradle'
-      - uses: bufbuild/buf-action@v1
+      - uses: bufbuild/buf-action@8f4a1456a0ab6a1eb80ba68e53832e6fcfacc16c # v1.3.0
         with:
           setup_only: true
       - env:
           BUF_TOKEN: ${{ secrets.BUF_TOKEN }}
         run: echo ${BUF_TOKEN} | buf registry login buf.build --token-stdin
       - name: Validate Gradle Wrapper
-        uses: gradle/actions/wrapper-validation@v5
+        uses: gradle/actions/wrapper-validation@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
       - name: Test conformance
         run: make conformance
diff --git a/.github/workflows/pr-hygiene.yaml b/.github/workflows/pr-hygiene.yaml
index 79e9a19d..f75d0bc7 100644
--- a/.github/workflows/pr-hygiene.yaml
+++ b/.github/workflows/pr-hygiene.yaml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Lint title
-        uses: morrisoncole/pr-lint-action@v1.7.1
+        uses: morrisoncole/pr-lint-action@51f3cfabaf5d46f94e54524214e45685f0401b2a # v1.7.1
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"
           # https://regex101.com/r/I6oK5v/1
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 3578f441..561d7c27 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -13,10 +13,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Cache Go Modules
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ~/.cache/go-build
@@ -26,12 +26,12 @@ jobs:
             ${{ runner.os }}-gomod-ci-
 
       - name: Set up JDK
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@dded0888837ed1f317902acf8a20df0ad188d165 # v5.0.0
         with:
           distribution: 'temurin'
           java-version: '21'
 
-      - uses: bufbuild/buf-action@v1
+      - uses: bufbuild/buf-action@8f4a1456a0ab6a1eb80ba68e53832e6fcfacc16c # v1.3.0
         with:
           setup_only: true
       - env:
@@ -39,7 +39,7 @@ jobs:
         run: echo ${BUF_TOKEN} | buf registry login buf.build --token-stdin
 
       - name: Validate Gradle Wrapper
-        uses: gradle/actions/wrapper-validation@v5
+        uses: gradle/actions/wrapper-validation@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # v5.0.0
 
       - name: Configure GPG signing & publish
         env: