diff --git a/.github/workflows/add-to-kanban.yml b/.github/workflows/add-to-kanban.yml
index 28640d5..603751a 100644
--- a/.github/workflows/add-to-kanban.yml
+++ b/.github/workflows/add-to-kanban.yml
@@ -10,7 +10,7 @@ jobs:
   add-to-project:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/add-to-project@v2.0.0
+      - uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd # v2.0.0
         with:
           project-url: https://github.com/orgs/tracebloc/projects/2
           github-token: ${{ secrets.PROJECTS_KANBAN_TOKEN }}
diff --git a/.github/workflows/backend-fixtures-drift.yml b/.github/workflows/backend-fixtures-drift.yml
index 642f1b1..0ab93a3 100644
--- a/.github/workflows/backend-fixtures-drift.yml
+++ b/.github/workflows/backend-fixtures-drift.yml
@@ -40,7 +40,7 @@ jobs:
     name: Backend fixtures drift check
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: scripts/sync-backend-fixtures.sh --check
         env:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 379933c..2bdd1cf 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -32,7 +32,7 @@ jobs:
     # (backend#1009).
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: scripts/sync-schema.sh --check
         run: ./scripts/sync-schema.sh --check
 
@@ -46,7 +46,7 @@ jobs:
     # closed when cosign is absent (RFC-0001 R8, backend#889).
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: shellcheck + dash parse
         run: |
           sudo apt-get update -qq && sudo apt-get install -y -qq shellcheck dash
@@ -62,10 +62,10 @@ jobs:
     name: Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
@@ -93,10 +93,10 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
@@ -200,10 +200,10 @@ jobs:
     # published between PRs). Bump deliberately.
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
@@ -243,10 +243,10 @@ jobs:
             arch: arm64
             ext: .exe
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
@@ -293,7 +293,7 @@ jobs:
           "$BIN" dataset push --help >/dev/null
 
       - name: Upload binary as artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: tracebloc-${{ matrix.os }}-${{ matrix.arch }}
           path: dist/tracebloc-${{ matrix.os }}-${{ matrix.arch }}${{ matrix.ext }}
diff --git a/.github/workflows/chart-drift.yml b/.github/workflows/chart-drift.yml
index 84c1e48..3312ddf 100644
--- a/.github/workflows/chart-drift.yml
+++ b/.github/workflows/chart-drift.yml
@@ -42,7 +42,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout this CLI ref
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           path: cli
 
@@ -65,14 +65,14 @@ jobs:
           echo "ref=$ref" >> "$GITHUB_OUTPUT"
 
       - name: Checkout tracebloc/client @ pinned ref
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: tracebloc/client
           ref: ${{ steps.pin.outputs.ref }}
           path: client
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: cli/go.mod
           cache: true
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index ac01092..6b71166 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -105,10 +105,10 @@ jobs:
       needs.changes.result == 'failure' ||
       needs.changes.outputs.e2e == 'true')
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
@@ -156,10 +156,10 @@ jobs:
       needs.changes.result == 'failure' ||
       needs.changes.outputs.e2e == 'true')
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
diff --git a/.github/workflows/golangci.yml b/.github/workflows/golangci.yml
index fac2e59..da4d148 100644
--- a/.github/workflows/golangci.yml
+++ b/.github/workflows/golangci.yml
@@ -44,10 +44,10 @@ jobs:
     # protection (backend#1305 / epic #930).
     # ==================================================================
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
diff --git a/.github/workflows/goldens-drift.yml b/.github/workflows/goldens-drift.yml
index 39282b4..cf0d7f5 100644
--- a/.github/workflows/goldens-drift.yml
+++ b/.github/workflows/goldens-drift.yml
@@ -52,7 +52,7 @@ jobs:
     name: Validator goldens vs data-ingestors @ pin
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Resolve the data-ingestors pin
         id: pin
@@ -125,7 +125,7 @@ jobs:
 
       - name: Checkout tracebloc/data-ingestors @ pin
         if: steps.access.outputs.ok == 'true'
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: tracebloc/data-ingestors
           ref: ${{ steps.pin.outputs.ref }}
@@ -138,7 +138,7 @@ jobs:
 
       - name: Set up Python
         if: steps.access.outputs.ok == 'true'
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.11'   # matches data-ingestors' own CI
           cache: pip
diff --git a/.github/workflows/head-drift-canary.yml b/.github/workflows/head-drift-canary.yml
index 25c6701..e36bb7b 100644
--- a/.github/workflows/head-drift-canary.yml
+++ b/.github/workflows/head-drift-canary.yml
@@ -47,7 +47,7 @@ jobs:
     name: Pin vs HEAD drift (advisory)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Resolve the data-ingestors pin
         id: pin
@@ -89,7 +89,7 @@ jobs:
           echo "use_pat=$use_pat" >> "$GITHUB_OUTPUT"
 
       - name: Checkout tracebloc/data-ingestors @ develop HEAD
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: tracebloc/data-ingestors
           ref: develop
@@ -159,7 +159,7 @@ jobs:
           } >> "$GITHUB_OUTPUT"
 
       - name: Set up Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.11'   # matches data-ingestors' own CI
           cache: pip
diff --git a/.github/workflows/install-path-persist.yml b/.github/workflows/install-path-persist.yml
index 87b08ff..82f993f 100644
--- a/.github/workflows/install-path-persist.yml
+++ b/.github/workflows/install-path-persist.yml
@@ -59,13 +59,13 @@ jobs:
     steps:
       # 1. This PR's CLI source — we test THIS install.sh, not the released one.
       - name: Checkout this CLI PR
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           path: cli
 
       # 2. The fresh-shell harness from tracebloc/client (single source of truth).
       - name: Checkout the client path-persist harness
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: tracebloc/client
           ref: ${{ env.CLIENT_HARNESS_REF }}
diff --git a/.github/workflows/mutation.yml b/.github/workflows/mutation.yml
index 21adeb9..edbe71b 100644
--- a/.github/workflows/mutation.yml
+++ b/.github/workflows/mutation.yml
@@ -47,10 +47,10 @@ jobs:
     name: Mutation (${{ inputs.package }})
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
@@ -110,7 +110,7 @@ jobs:
 
       - name: Upload machine-readable report
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: gremlins-report
           path: |
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e1f9c2b..ab68e29 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -94,13 +94,13 @@ jobs:
             ext: .exe
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.ref }}
           fetch-depth: 0
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
@@ -190,7 +190,7 @@ jobs:
           cat "$BIN_NAME.sha256"
 
       - name: Upload per-matrix artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: dist-${{ matrix.os }}-${{ matrix.arch }}
           path: dist/
@@ -206,12 +206,12 @@ jobs:
       contents: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.ref }}
 
       - name: Download all matrix artifacts
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           path: dist/
           merge-multiple: true
diff --git a/.github/workflows/stale-backlog.yml b/.github/workflows/stale-backlog.yml
index 9b46fc3..4e42463 100644
--- a/.github/workflows/stale-backlog.yml
+++ b/.github/workflows/stale-backlog.yml
@@ -13,7 +13,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v11
+      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
         with:
           days-before-issue-stale: 42  # 6 weeks of no activity → warning
           days-before-issue-close: 14  # +2 weeks of silence → close
diff --git a/.github/workflows/vulncheck.yml b/.github/workflows/vulncheck.yml
index e467fb9..0a261b5 100644
--- a/.github/workflows/vulncheck.yml
+++ b/.github/workflows/vulncheck.yml
@@ -33,12 +33,12 @@ jobs:
     name: govulncheck (develop)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: develop
 
       - name: Set up Go
-        uses: actions/setup-go@v7
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version-file: go.mod
           cache: true