diff --git a/.github/workflows/build-container-reusable.yml b/.github/workflows/build-container-reusable.yml
index 5bcccbf36..7171983b4 100644
--- a/.github/workflows/build-container-reusable.yml
+++ b/.github/workflows/build-container-reusable.yml
@@ -34,37 +34,37 @@ jobs:
     name: ${{ format('{0} / {1}', inputs.container-runtime, inputs.test-group-name) }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
       - name: Install task runner
         id: mise
-        uses: jdx/mise-action@v4.3.0
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           version: 2026.8.2
           install: false
           cache: false
       - name: Install net10.0
-        uses: actions/setup-dotnet@v6
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: 10.0.x
         if: ${{ inputs.mode != 'test-only' }}
       - name: Setup QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@1f40c72289eff860ee54a304f1438e3cff362e0a # v4.3.0
         if: ${{ inputs.mode != 'test-only' }}
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
         if: ${{ inputs.mode != 'test-only' }}
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         if: ${{ inputs.mode != 'test-only' }}
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         if: ${{ inputs.mode != 'test-only' }}
         with:
           context: .
@@ -84,7 +84,7 @@ jobs:
         if: ${{ inputs.mode != 'test-only' }}
         run: mise run --skip-tools github-actions:container -- verify
       - name: Build Test Container
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         if: ${{ inputs.mode != 'test-only' }}
         with:
           context: .
@@ -105,7 +105,7 @@ jobs:
         if: ${{ inputs.mode == 'build-only' }}
         run: mise run --skip-tools github-actions:container -- export-runtime
       - name: Publish Test Container
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: ${{ inputs.mode == 'build-only' }}
         with:
           name: ${{ inputs.test-image-artifact-name }}
@@ -113,7 +113,7 @@ jobs:
           if-no-files-found: error
           retention-days: 1
       - name: Publish Container
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: ${{ inputs.mode == 'build-only' }}
         with:
           name: ${{ inputs.image-artifact-name }}
@@ -121,7 +121,7 @@ jobs:
           if-no-files-found: error
           retention-days: 1
       - name: Download Test Container
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         if: ${{ inputs.mode == 'test-only' }}
         with:
           name: ${{ inputs.test-image-artifact-name }}
@@ -137,7 +137,7 @@ jobs:
         if: ${{ failure() && steps.mise.outcome == 'success' }}
         run: mise run --skip-tools github-actions:container -- normalize-results
       - name: Publish Test Results
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: failure()
         with:
           name: test-results-${{ inputs.container-runtime }}-${{ inputs.test-group-name }}
diff --git a/.github/workflows/build-container-ubuntu-lts.yml b/.github/workflows/build-container-ubuntu-lts.yml
index 3e7e80eff..91ffc103f 100644
--- a/.github/workflows/build-container-ubuntu-lts.yml
+++ b/.github/workflows/build-container-ubuntu-lts.yml
@@ -67,17 +67,17 @@ jobs:
       contents: read
     steps:
       - name: Checkout server
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install task runner
-        uses: jdx/mise-action@v4.3.0
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           version: 2026.8.2
           install: false
           cache: false
       - name: Install net10.0
-        uses: actions/setup-dotnet@v6
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: 10.0.x
       - name: Install Rust
@@ -90,21 +90,21 @@ jobs:
         id: clients
         run: mise run --skip-tools github-actions:client-compatibility -- refs
       - name: Checkout C# client
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: TrogonStack/TrogonEventStore-Client-Dotnet
           ref: ${{ steps.clients.outputs.dotnet }}
           path: .github/compatibility/clients/dotnet
           persist-credentials: false
       - name: Checkout Rust client
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: TrogonStack/TrogonEventStore-Client-Rust
           ref: ${{ steps.clients.outputs.rust }}
           path: .github/compatibility/clients/rust
           persist-credentials: false
       - name: Download server image
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: eventstore-image-noble-linux-x64
       - name: Load server image
@@ -112,7 +112,7 @@ jobs:
       - name: Run client compatibility gate
         run: mise run --skip-tools github-actions:client-compatibility -- run
       - name: Publish compatibility evidence
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         with:
           name: client-compatibility
diff --git a/.github/workflows/build-reusable.yml b/.github/workflows/build-reusable.yml
index 242d27171..b9ee8a51a 100644
--- a/.github/workflows/build-reusable.yml
+++ b/.github/workflows/build-reusable.yml
@@ -24,16 +24,16 @@ jobs:
     name: ${{ inputs.os }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Install net10.0
-        uses: actions/setup-dotnet@v6
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: 10.0.x
       - name: Install task runner
         id: mise
-        uses: jdx/mise-action@v4.3.0
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           version: 2026.8.2
           install_args: protoc
@@ -63,13 +63,13 @@ jobs:
         if: ${{ always() && steps.mise.outcome == 'success' }}
         run: mise run --skip-tools github-actions:dotnet-build -- collect-results
       - name: Publish Test Results (HTML)
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         with:
           path: test-results.html
           name: test-results-${{ matrix.configuration }}-${{ inputs.os }}.html
       - name: Publish Test Results (All)
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         with:
           name: test-results-${{ matrix.configuration }}-${{ inputs.os }}
diff --git a/.github/workflows/cherry-pick-pr-for-label.yml b/.github/workflows/cherry-pick-pr-for-label.yml
index b6d56f5c1..2b94498f4 100644
--- a/.github/workflows/cherry-pick-pr-for-label.yml
+++ b/.github/workflows/cherry-pick-pr-for-label.yml
@@ -7,8 +7,8 @@ jobs:
     name: Cherry pick PR commits for label
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Cherry Pick PR for label
-        uses: EventStore/Automations/cherry-pick-pr-for-label@master
+        uses: EventStore/Automations/cherry-pick-pr-for-label@2722c4ba047cf2c9806fe7a2bad8712bb545e0d7 # master
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/common.yml b/.github/workflows/common.yml
index 6958731eb..3bf83919b 100644
--- a/.github/workflows/common.yml
+++ b/.github/workflows/common.yml
@@ -27,11 +27,11 @@ jobs:
     name: Semantic Conventions
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install repository tools
-        uses: jdx/mise-action@v4.3.0
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           version: 2026.8.2
           install_args: github:open-telemetry/weaver
@@ -44,15 +44,15 @@ jobs:
     name: C# Quality
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Install net10.0
-        uses: actions/setup-dotnet@v6
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: 10.0.x
       - name: Install task runner
-        uses: jdx/mise-action@v4.3.0
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           version: 2026.8.2
           install: false
@@ -92,13 +92,13 @@ jobs:
     name: Scan for Vulnerabilities
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install net10.0
-        uses: actions/setup-dotnet@v6
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: 10.0.x
       - name: Install task runner
-        uses: jdx/mise-action@v4.3.0
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           version: 2026.8.2
           install: false
@@ -116,7 +116,7 @@ jobs:
     name: Protolock Status
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Protolock Status
         shell: bash
         run: |
@@ -127,12 +127,12 @@ jobs:
     name: Release Metadata
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           persist-credentials: false
       - name: Install task runner
-        uses: jdx/mise-action@v4.3.0
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           version: 2026.8.2
           install: false
@@ -166,15 +166,15 @@ jobs:
           --health-retries 30
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install net10.0
-        uses: actions/setup-dotnet@v6
+        uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
         with:
           dotnet-version: 10.0.x
       - name: Install task runner
-        uses: jdx/mise-action@v4.3.0
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           version: 2026.8.2
           install: false
@@ -218,15 +218,15 @@ jobs:
     name: Docker Compose Smoke Test
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install task runner
-        uses: jdx/mise-action@v4.3.0
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           version: 2026.8.2
           install: false
           cache: false
       - name: Github Registry Docker Login
-        uses: docker/login-action@v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: docker.pkg.github.com
           username: ${{ github.actor }}
diff --git a/.github/workflows/license.yml b/.github/workflows/license.yml
index 6da05b45f..6eea75c20 100644
--- a/.github/workflows/license.yml
+++ b/.github/workflows/license.yml
@@ -9,10 +9,10 @@ jobs:
   run:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 0
-    - uses: FantasticFiasco/action-update-license-year@v3
+    - uses: FantasticFiasco/action-update-license-year@f180e962fa988db222d8f03ef4636750312d1b3d # v3.0.4
       with:
         path: LICENSE.md
         labels: 'cherry-pick:release/v5,cherry-pick:release/v20.10,cherry-pick:release/v21.10'
diff --git a/.github/workflows/tag-docker-images.yml b/.github/workflows/tag-docker-images.yml
index 86994644b..63c9bbb52 100644
--- a/.github/workflows/tag-docker-images.yml
+++ b/.github/workflows/tag-docker-images.yml
@@ -13,23 +13,23 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: Install task runner
-        uses: jdx/mise-action@v4.3.0
+        uses: jdx/mise-action@c2a87611a18de5b3828c5652fe268e992400cb5c # v4.3.0
         with:
           version: 2026.8.2
           install: false
           cache: false
       - name: Download Container
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: ${{ inputs.image-artifact-name }}
       - name: Load Container
         run: mise run --skip-tools github-actions:container -- load-runtime
       - name: Login to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}