diff --git a/.github/workflows/block_major_releases.yml b/.github/workflows/block_major_releases.yml
index 3f69bcff5..59696502c 100644
--- a/.github/workflows/block_major_releases.yml
+++ b/.github/workflows/block_major_releases.yml
@@ -15,7 +15,7 @@ jobs:
       pull-requests: read
     steps:
       - name: Enforce Multiple Approvals for Major Releases
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           script: |
             const prTitle = context.payload.pull_request.title;
diff --git a/.github/workflows/google-contributor-stale.yml b/.github/workflows/google-contributor-stale.yml
index ebff9cfcd..d4c14677d 100644
--- a/.github/workflows/google-contributor-stale.yml
+++ b/.github/workflows/google-contributor-stale.yml
@@ -14,7 +14,7 @@ jobs:
       issues: write
 
     steps:
-      - uses: actions/stale@v10
+      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10
         with:
           repo-token: ${{ secrets.GITHUB_TOKEN }}
           any-of-labels: "google-contributor"
diff --git a/.github/workflows/import.yml b/.github/workflows/import.yml
index 8a110616b..8678cdbf2 100644
--- a/.github/workflows/import.yml
+++ b/.github/workflows/import.yml
@@ -6,6 +6,8 @@ on:
     branches: [ main ]
   pull_request:
     branches: [ main ]
+permissions:
+  contents: read
 
 jobs:
   test-import:
@@ -17,10 +19,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -33,4 +37,4 @@ jobs:
 
       - name: Run import test
         run: |
-          pytest google/genai/tests/imports/test_no_optional_imports.py
\ No newline at end of file
+          pytest google/genai/tests/imports/test_no_optional_imports.py
diff --git a/.github/workflows/mypy.yml b/.github/workflows/mypy.yml
index b189419de..5a8041e64 100644
--- a/.github/workflows/mypy.yml
+++ b/.github/workflows/mypy.yml
@@ -8,6 +8,8 @@ on:
   pull_request:
     branches:
       - main
+permissions:
+  contents: read
 
 jobs:
   mypy:
@@ -18,10 +20,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        with:
+          persist-credentials: false
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -33,4 +37,4 @@ jobs:
           pip install -r requirements.txt
 
       - name: Run mypy  ${{ matrix.python-version }}
-        run: mypy google/genai/
\ No newline at end of file
+        run: mypy google/genai/
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index dff9b18fc..876c52c74 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -16,7 +16,7 @@ jobs:
       pull-requests: write
 
     steps:
-    - uses: actions/stale@v10
+    - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         days-before-issue-stale: 7