diff --git a/.github/workflows/css-lint.yml b/.github/workflows/css-lint.yml
index 1eb679d29..8f13d7238 100644
--- a/.github/workflows/css-lint.yml
+++ b/.github/workflows/css-lint.yml
@@ -31,15 +31,15 @@ jobs:
 
     steps:
     - name: Check out code
-      uses: actions/checkout@v6
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
     - name: Set up Node.js
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
       with:
         node-version: lts/*
 
     - name: Restore Node.js dependencies cache
-      uses: actions/cache/restore@v5
+      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       id: cache-restore
       with:
         path: node_modules
@@ -53,7 +53,7 @@ jobs:
 
     - name: Save Node.js dependencies cache
       if: steps.cache-restore.outputs.cache-hit != 'true'
-      uses: actions/cache/save@v5
+      uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         path: node_modules
         key: ${{ runner.os }}-node-${{ hashFiles('package-lock.json') }}
diff --git a/.github/workflows/docker-code-quality.yml b/.github/workflows/docker-code-quality.yml
index 644810a1f..19215e4f3 100644
--- a/.github/workflows/docker-code-quality.yml
+++ b/.github/workflows/docker-code-quality.yml
@@ -29,10 +29,10 @@ jobs:
 
     steps:
     - name: Check out code
-      uses: actions/checkout@v6
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
     - name: Validate configuration
-      uses: docker/build-push-action@v7
+      uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
       with:
         context: .
         file: ${{ matrix.image.dockerfile }}
diff --git a/.github/workflows/javascript-code-quality.yml b/.github/workflows/javascript-code-quality.yml
index 1dca32897..a6cdda555 100644
--- a/.github/workflows/javascript-code-quality.yml
+++ b/.github/workflows/javascript-code-quality.yml
@@ -29,15 +29,15 @@ jobs:
 
     steps:
     - name: Check out code
-      uses: actions/checkout@v6
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
     - name: Set up Node.js
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
       with:
         node-version: lts/*
 
     - name: Restore Node.js dependencies cache
-      uses: actions/cache/restore@v5
+      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       id: cache-restore
       with:
         path: node_modules
@@ -51,7 +51,7 @@ jobs:
 
     - name: Save Node.js dependencies cache
       if: steps.cache-restore.outputs.cache-hit != 'true'
-      uses: actions/cache/save@v5
+      uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         path: node_modules
         key: ${{ runner.os }}-node-${{ hashFiles('package-lock.json') }}
diff --git a/.github/workflows/php-code-quality.yml b/.github/workflows/php-code-quality.yml
index 348041179..7f152a947 100644
--- a/.github/workflows/php-code-quality.yml
+++ b/.github/workflows/php-code-quality.yml
@@ -27,10 +27,10 @@ jobs:
 
     steps:
     - name: Check out code
-      uses: actions/checkout@v6
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
     - name: Set up PHP
-      uses: shivammathur/setup-php@v2
+      uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0
       with:
         php-version: '8.5'
         coverage: none
@@ -39,7 +39,7 @@ jobs:
 
     # https://phpstan.org/user-guide/result-cache
     - name: Restore result cache
-      uses: actions/cache/restore@v5
+      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         path: .phpstan-tmp
         key: phpstan-result-cache-${{ github.run_id }}
@@ -51,7 +51,7 @@ jobs:
 
     # https://phpstan.org/user-guide/result-cache
     - name: Save result cache
-      uses: actions/cache/save@v5
+      uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       if: ${{ !cancelled() }}
       with:
         # same as in phpstan.neon
@@ -73,10 +73,10 @@ jobs:
 
     steps:
     - name: Check out code
-      uses: actions/checkout@v6
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
     - name: Set up PHP ${{ matrix.php }}
-      uses: shivammathur/setup-php@v2
+      uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0
       with:
         # Check https://phpunit.de/supported-versions.html for PHP version compatibility
         php-version: ${{ matrix.php }}
@@ -96,10 +96,10 @@ jobs:
 
     steps:
     - name: Check out code
-      uses: actions/checkout@v6
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
     - name: Set up PHP
-      uses: shivammathur/setup-php@v2
+      uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0
       with:
         php-version: latest
         coverage: none
@@ -107,7 +107,7 @@ jobs:
 
     # https://getrector.com/documentation/cache-in-ci#content-github-actions
     - name: Restore result cache
-      uses: actions/cache/restore@v5
+      uses: actions/cache/restore@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         path: .rector-tmp
         key: rector-result-cache-${{ github.run_id }}
@@ -119,7 +119,7 @@ jobs:
 
     # https://getrector.com/documentation/cache-in-ci#content-github-actions
     - name: Save result cache
-      uses: actions/cache/save@v5
+      uses: actions/cache/save@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       if: ${{ !cancelled() }}
       with:
         # same as in rector.php
diff --git a/.github/workflows/publish-version-json.yml b/.github/workflows/publish-version-json.yml
index 14b4ecca4..4dd0017a7 100644
--- a/.github/workflows/publish-version-json.yml
+++ b/.github/workflows/publish-version-json.yml
@@ -18,7 +18,7 @@ jobs:
 
     steps:
     - name: Check out code
-      uses: actions/checkout@v6
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
     - name: Generate version.json
       run: |
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index cc88cda6d..c92fdbdd1 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -66,7 +66,7 @@ jobs:
 
     steps:
     - name: Check out code
-      uses: actions/checkout@v6
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
     - name: Get commit timestamp
       run: |
@@ -79,21 +79,21 @@ jobs:
         echo "COMMIT_SHORT_SHA=$COMMIT_SHORT_SHA" >> "$GITHUB_ENV"
 
     - name: Log in to GitHub Container Registry
-      uses: docker/login-action@v4
+      uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
       with:
         registry: ghcr.io
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Log in to Docker Hub
-      uses: docker/login-action@v4
+      uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
       with:
         username: ${{ secrets.DOCKERHUB_USERNAME }}
         password: ${{ secrets.DOCKERHUB_TOKEN }}
 
     - name: Extract metadata
       id: meta
-      uses: docker/metadata-action@v6
+      uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
       with:
         images: |
           ${{ matrix.image.repository_dockerhub }}
@@ -107,14 +107,14 @@ jobs:
           type=raw,value={{commit_date 'YYYYMMDD-HHmmss'}}
 
     - name: Set up QEMU
-      uses: docker/setup-qemu-action@v4
+      uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
 
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v4
+      uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
 
     - name: Build and push to image registries
       id: push
-      uses: docker/build-push-action@v7
+      uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
       with:
         context: .
         file: ${{ matrix.image.dockerfile }}
diff --git a/.github/workflows/shell-code-quality.yml b/.github/workflows/shell-code-quality.yml
index c2a65f33a..08cb9b542 100644
--- a/.github/workflows/shell-code-quality.yml
+++ b/.github/workflows/shell-code-quality.yml
@@ -27,7 +27,7 @@ jobs:
 
     steps:
     - name: Check out code
-      uses: actions/checkout@v6
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
     - name: Run ShellCheck
       run: |
diff --git a/.github/workflows/update-plugins-json.yml b/.github/workflows/update-plugins-json.yml
index 191f4f03f..5b5687daa 100644
--- a/.github/workflows/update-plugins-json.yml
+++ b/.github/workflows/update-plugins-json.yml
@@ -16,10 +16,10 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
     - name: Set up PHP
-      uses: shivammathur/setup-php@v2
+      uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0
       with:
         php-version: '8.5'
         tools: none
diff --git a/.github/workflows/validate-sql.yml b/.github/workflows/validate-sql.yml
index 59bd9ee8e..fde2815cd 100644
--- a/.github/workflows/validate-sql.yml
+++ b/.github/workflows/validate-sql.yml
@@ -50,7 +50,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Wait for PostgreSQL
         run: |
@@ -77,7 +77,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Validate migration files
         run: |