diff --git a/.github/workflows/base120.yml b/.github/workflows/base120.yml
index 980a327..9b71b19 100644
--- a/.github/workflows/base120.yml
+++ b/.github/workflows/base120.yml
@@ -16,7 +16,7 @@ jobs:
   mirror-guard:
     runs-on: [self-hosted, Linux, X64, wsl, base120]
     steps:
-      - uses: actions/checkout@v6.0.3
+      - actions/checkout@9f698171ed81b15d1823a05fc7211befd50c8ae0 # v6.0.3
 
       - name: Enforce mirror corpus compliance
         run: |
@@ -27,10 +27,10 @@ jobs:
   test:
     runs-on: [self-hosted, Linux, X64, wsl, base120]
     steps:
-      - uses: actions/checkout@v6.0.3
+      - actions/checkout@9f698171ed81b15d1823a05fc7211befd50c8ae0 # v6.0.3
 
       - name: Set up Python
-        uses: actions/setup-python@v6
+        actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.13"
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 378b01c..6483efe 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,7 +16,7 @@ jobs:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+        actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: ${{ matrix.python-version }}
 
diff --git a/.github/workflows/guardrails.yml b/.github/workflows/guardrails.yml
index 5fea8e7..8334dbe 100644
--- a/.github/workflows/guardrails.yml
+++ b/.github/workflows/guardrails.yml
@@ -13,8 +13,8 @@ jobs:
   corpus:
     runs-on: [self-hosted, Linux, X64, wsl, base120]
     steps:
-      - uses: actions/checkout@v6.0.3
-      - uses: actions/setup-python@v6
+      - actions/checkout@9f698171ed81b15d1823a05fc7211befd50c8ae0 # v6.0.3
+      - actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6
         with:
           python-version: "3.13"
       - run: |
diff --git a/.github/workflows/mirror-conformance.yml b/.github/workflows/mirror-conformance.yml
index 62c8b70..d76bf1b 100644
--- a/.github/workflows/mirror-conformance.yml
+++ b/.github/workflows/mirror-conformance.yml
@@ -40,12 +40,12 @@ jobs:
     
     steps:
       - name: Checkout mirror repository
-        uses: actions/checkout@v6.0.3
+        actions/checkout@9f698171ed81b15d1823a05fc7211befd50c8ae0 # v6.0.3
         with:
           path: mirror-repo
       
       - name: Checkout canonical Base120 repository
-        uses: actions/checkout@v6.0.3
+        actions/checkout@9f698171ed81b15d1823a05fc7211befd50c8ae0 # v6.0.3
         with:
           repository: hummbl-dev/base120
           ref: main
@@ -381,7 +381,7 @@ jobs:
       
       - name: Post PR comment with results
         if: github.event_name == 'pull_request'
-        uses: actions/github-script@v9
+        actions/github-script@373c709c69115d41ff229c7e5df9f8788daa9553 # v9
         with:
           script: |
             const passed = '${{ steps.summary.outputs.passed }}' === 'true';