diff --git a/.github/actions/run-fixture-tests/action.yml b/.github/actions/run-fixture-tests/action.yml
index 9947f6b8e..c78501e66 100644
--- a/.github/actions/run-fixture-tests/action.yml
+++ b/.github/actions/run-fixture-tests/action.yml
@@ -63,7 +63,7 @@ runs:
 
     - name: Restore test fixtures cache
       id: cache-fixtures
-      uses: actions/cache/restore@v5
+      uses: actions/cache/restore@v5.1.0
       with:
         path: leanSpec/fixtures
         key: leanspec-fixtures-${{ steps.fixtures-release.outputs.sha }}
@@ -98,7 +98,7 @@ runs:
         always()
         && steps.cache-fixtures.outputs.cache-hit != 'true'
         && steps.download-fixtures.outcome == 'success'
-      uses: actions/cache/save@v5
+      uses: actions/cache/save@v5.1.0
       with:
         path: leanSpec/fixtures
         key: ${{ steps.cache-fixtures.outputs.cache-primary-key }}
@@ -117,7 +117,7 @@ runs:
     # Keyed by target so the two halves do not evict each other: the default
     # key covers the job id, which is one value for every leg of a matrix.
     - name: Setup cache
-      uses: Swatinem/rust-cache@v2
+      uses: Swatinem/rust-cache@v2.9.3
       with:
         key: ${{ inputs.make-target }}
 
diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
new file mode 100644
index 000000000..155a726fa
--- /dev/null
+++ b/.github/workflows/actions.lock
@@ -0,0 +1,137 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/ai-review.yml': []
+    '.github/workflows/ci.yml':
+        - 'actions/cache@v5.1.0'
+        - 'actions/checkout@v6.1.0'
+        - 'dtolnay/rust-toolchain@master'
+        - 'swatinem/rust-cache@v2.9.3'
+    '.github/workflows/daily_ci.yml':
+        - 'actions/cache@v5.1.0'
+        - 'actions/checkout@v6.1.0'
+        - 'dtolnay/rust-toolchain@master'
+        - 'swatinem/rust-cache@v2.9.3'
+    '.github/workflows/daily_loc_report.yml':
+        - 'actions/cache@v5.1.0'
+        - 'actions/checkout@v6.1.0'
+        - 'dtolnay/rust-toolchain@master'
+        - 'swatinem/rust-cache@v2.9.3'
+    '.github/workflows/docker_publish.yaml':
+        - 'actions/checkout@v6.1.0'
+        - 'docker/build-push-action@v6.19.2'
+        - 'docker/login-action@v3.7.0'
+        - 'docker/setup-buildx-action@v3.12.0'
+    '.github/workflows/era_replay.yml':
+        - 'actions/checkout@v6.1.0'
+        - 'actions/upload-artifact@v4.6.2'
+    '.github/workflows/kurtosis_assertoor.yml':
+        - 'actions/checkout@v6.1.0'
+        - 'actions/upload-artifact@v7.0.2'
+    '.github/workflows/pr-main_mdbook.yml':
+        - 'actions/checkout@v6.1.0'
+        - 'actions/download-artifact@v8.0.2'
+        - 'actions/upload-artifact@v7.0.2'
+        - 'dtolnay/rust-toolchain@master'
+        - 'lycheeverse/lychee-action@v2.9.0'
+        - 'peaceiris/actions-gh-pages@v4.1.0'
+        - 'peaceiris/actions-mdbook@v2.0.0'
+        - 'swatinem/rust-cache@v2.9.3'
+    '.github/workflows/pr_lint_gha.yaml':
+        - 'actions/checkout@v6.1.0'
+    '.github/workflows/pr_lint_license.yaml':
+        - 'actions/checkout@v6.1.0'
+    '.github/workflows/release.yaml':
+        - 'actions/attest@v4.2.2'
+        - 'actions/checkout@v6.1.0'
+        - 'actions/download-artifact@v8.0.2'
+        - 'actions/upload-artifact@v7.0.2'
+        - 'docker/build-push-action@v6.19.2'
+        - 'docker/login-action@v3.7.0'
+        - 'docker/setup-buildx-action@v3.12.0'
+        - 'dtolnay/rust-toolchain@master'
+        - 'requarks/changelog-action@v1.10.3'
+    '.github/workflows/release_promote.yaml':
+        - 'actions/attest@v4.2.2'
+        - 'docker/login-action@v3.7.0'
+        - 'docker/setup-buildx-action@v3.12.0'
+    '.github/workflows/verify-lockfile.yml':
+        - 'actions/checkout@v6.1.0'
+dependencies:
+    'actions/attest@v4.2.2':
+        ref: 'v4.2.2'
+        commit: 'sha1-1e69f48acb82d1966a394da916b4c1698aa569d6'
+        owner_id: 44036562
+        repo_id: 760701061
+    'actions/cache@v5.1.0':
+        ref: 'v5.1.0'
+        commit: 'sha1-caa296126883cff596d87d8935842f9db880ef25'
+        owner_id: 44036562
+        repo_id: 215566462
+    'actions/checkout@v6.1.0':
+        ref: 'v6.1.0'
+        commit: 'sha1-d23441a48e516b6c34aea4fa41551a30e30af803'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/download-artifact@v8.0.2':
+        ref: 'v8.0.2'
+        commit: 'sha1-9000827ccba6bdab643e8b6fd33ac0654aef8333'
+        owner_id: 44036562
+        repo_id: 192626254
+    'actions/upload-artifact@v4.6.2':
+        ref: 'v4.6.2'
+        commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
+        owner_id: 44036562
+        repo_id: 192625955
+    'actions/upload-artifact@v7.0.2':
+        ref: 'v7.0.2'
+        commit: 'sha1-cf430e030ddbb5b0abf93d22962f4752f3646cd9'
+        owner_id: 44036562
+        repo_id: 192625955
+    'docker/build-push-action@v6.19.2':
+        ref: 'v6.19.2'
+        commit: 'sha1-10e90e3645eae34f1e60eeb005ba3a3d33f178e8'
+        owner_id: 5429470
+        repo_id: 241092383
+    'docker/login-action@v3.7.0':
+        ref: 'v3.7.0'
+        commit: 'sha1-c94ce9fb468520275223c153574b00df6fe4bcc9'
+        owner_id: 5429470
+        repo_id: 287743349
+    'docker/setup-buildx-action@v3.12.0':
+        ref: 'v3.12.0'
+        commit: 'sha1-8d2750c68a42422c14e847fe6c8ac0403b4cbd6f'
+        owner_id: 5429470
+        repo_id: 288485773
+    'dtolnay/rust-toolchain@master':
+        ref: 'master'
+        commit: 'sha1-683b588c487a69d01f6c6ddf40f036ff682cc2c8'
+        owner_id: 1940490
+        repo_id: 260749683
+    'lycheeverse/lychee-action@v2.9.0':
+        ref: 'v2.9.0'
+        commit: 'sha1-e7477775783ea5526144ba13e8db5eec57747ce8'
+        owner_id: 74027027
+        repo_id: 320929718
+    'peaceiris/actions-gh-pages@v4.1.0':
+        ref: 'v4.1.0'
+        commit: 'sha1-84c30a85c19949d7eee79c4ff27748b70285e453'
+        owner_id: 30958501
+        repo_id: 187915200
+    'peaceiris/actions-mdbook@v2.0.0':
+        ref: 'v2.0.0'
+        commit: 'sha1-ee69d230fe19748b7abf22df32acaa93833fad08'
+        owner_id: 30958501
+        repo_id: 224423059
+    'requarks/changelog-action@v1.10.3':
+        ref: 'v1.10.3'
+        commit: 'sha1-b78a3354a01f4a1affb484b9264b506a815c46b1'
+        owner_id: 16729233
+        repo_id: 450329078
+    'swatinem/rust-cache@v2.9.3':
+        ref: 'v2.9.3'
+        commit: 'sha1-d1527c8f67ef9af357290475d4af4b0fab8f12e0'
+        owner_id: 580492
+        repo_id: 298565987
diff --git a/.github/workflows/ai-review.yml b/.github/workflows/ai-review.yml
index 0c4d5f4ef..f05531518 100644
--- a/.github/workflows/ai-review.yml
+++ b/.github/workflows/ai-review.yml
@@ -22,18 +22,18 @@ on:
 jobs:
   kimi-review:
     if: github.event_name == 'issue_comment' || github.event.pull_request.draft == false
-    uses: lambdaclass/actions/.github/workflows/ai-review-kimi.yml@v1
+    uses: lambdaclass/actions/.github/workflows/ai-review-kimi.yml@212745563f1482299f563a3eb97909953df2a201 # v1
     secrets:
       KIMI_API_KEY: ${{ secrets.KIMI_API_KEY }}
 
   codex-review:
     if: github.event_name == 'issue_comment' || github.event.pull_request.draft == false
-    uses: lambdaclass/actions/.github/workflows/ai-review-codex.yml@v1
+    uses: lambdaclass/actions/.github/workflows/ai-review-codex.yml@212745563f1482299f563a3eb97909953df2a201 # v1
     secrets:
       OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
 
   claude-review:
     if: github.event_name == 'issue_comment' || github.event.pull_request.draft == false
-    uses: lambdaclass/actions/.github/workflows/ai-review-claude.yml@v1
+    uses: lambdaclass/actions/.github/workflows/ai-review-claude.yml@212745563f1482299f563a3eb97909953df2a201 # v1
     secrets:
       ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index f9a4bb233..bb50e5dc8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -36,9 +36,9 @@ jobs:
     name: Lint
     runs-on: ${{ vars.ETHLAMBDA_RUNNER || 'ubuntu-latest' }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
 
-      - uses: ./.github/actions/free-disk
+      - uses: $/.github/actions/free-disk
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@master
@@ -47,7 +47,7 @@ jobs:
           components: rustfmt, clippy
 
       - name: Setup cache
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@v2.9.3
 
       - name: Check formatting
         run: cargo fmt --all -- --check
@@ -90,9 +90,9 @@ jobs:
     name: Test minimal preset
     runs-on: ${{ vars.ETHLAMBDA_RUNNER || 'ubuntu-latest' }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
 
-      - uses: ./.github/actions/free-disk
+      - uses: $/.github/actions/free-disk
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@master
@@ -104,7 +104,7 @@ jobs:
       # builds share almost no artifacts with `lint`'s, so on one key each run
       # would evict the other's.
       - name: Setup cache
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@v2.9.3
 
       - name: Check the beacon spec-test suite compiles
         run: |
@@ -127,7 +127,7 @@ jobs:
     name: Tooling
     runs-on: ${{ vars.ETHLAMBDA_RUNNER || 'ubuntu-latest' }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@master
@@ -136,7 +136,7 @@ jobs:
           components: rustfmt, clippy
 
       - name: Setup cache
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@v2.9.3
         with:
           workspaces: tooling/event-monitor
 
@@ -162,12 +162,12 @@ jobs:
       matrix:
         half: [consensus, node]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
 
-      - uses: ./.github/actions/free-disk
+      - uses: $/.github/actions/free-disk
 
       - name: Run fixture-based tests
-        uses: ./.github/actions/run-fixture-tests
+        uses: $/.github/actions/run-fixture-tests
         with:
           make-target: test-${{ matrix.half }}
 
@@ -185,9 +185,9 @@ jobs:
     name: Benchmark smoke
     runs-on: ${{ vars.ETHLAMBDA_RUNNER || 'ubuntu-latest' }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
 
-      - uses: ./.github/actions/free-disk
+      - uses: $/.github/actions/free-disk
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@master
@@ -195,7 +195,7 @@ jobs:
           toolchain: "1.97.1"
 
       - name: Setup cache
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@v2.9.3
 
       - name: Benchmark smoke (mock crypto)
         run: |
@@ -212,7 +212,7 @@ jobs:
     name: Dependency cooldown
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
 
       - name: Check lockfiles against the publish-age cooldown
         run: |
@@ -263,9 +263,9 @@ jobs:
       # vectors are a separate download (`make cryptography-specs`) below.
       CONSENSUS_SPEC_TESTS_CONFIGS: ${{ matrix.preset }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
 
-      - uses: ./.github/actions/free-disk
+      - uses: $/.github/actions/free-disk
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@master
@@ -276,7 +276,7 @@ jobs:
       # which are const-generic arguments, so the two legs share no artifacts at
       # all; on one key they would evict each other on every single run.
       - name: Setup cache
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@v2.9.3
         with:
           key: beacon-${{ matrix.preset }}
 
diff --git a/.github/workflows/daily_ci.yml b/.github/workflows/daily_ci.yml
index ab349d353..111cceae8 100644
--- a/.github/workflows/daily_ci.yml
+++ b/.github/workflows/daily_ci.yml
@@ -41,10 +41,10 @@ jobs:
       matrix:
         half: [consensus, node]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
 
       - name: Run fixture-based tests
-        uses: ./.github/actions/run-fixture-tests
+        uses: $/.github/actions/run-fixture-tests
         with:
           make-target: test-${{ matrix.half }}
 
@@ -57,7 +57,7 @@ jobs:
     if: always()
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
 
       - name: Build Slack payload
         # Context values are passed through the environment (never interpolated
diff --git a/.github/workflows/daily_loc_report.yml b/.github/workflows/daily_loc_report.yml
index c7ddf52ce..853ed6e18 100644
--- a/.github/workflows/daily_loc_report.yml
+++ b/.github/workflows/daily_loc_report.yml
@@ -34,7 +34,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout sources
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.1.0
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@master
@@ -42,14 +42,14 @@ jobs:
           toolchain: "1.97.1"
 
       - name: Setup cache
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@v2.9.3
 
       - name: Install cargo-warloc
         run: cargo install cargo-warloc --locked --version 0.1.1
 
       - name: Restore previous LoC report
         id: cache-loc-report
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@v5.1.0
         with:
           path: loc_report.json
           key: loc-report-${{ github.ref_name }}-${{ github.run_id }}
@@ -65,7 +65,7 @@ jobs:
 
       - name: Save new LoC report to cache
         if: success()
-        uses: actions/cache/save@v5
+        uses: actions/cache/save@v5.1.0
         with:
           path: loc_report.json
           key: loc-report-${{ github.ref_name }}-${{ github.run_id }}
diff --git a/.github/workflows/docker_publish.yaml b/.github/workflows/docker_publish.yaml
index efe69bace..70ac598e0 100644
--- a/.github/workflows/docker_publish.yaml
+++ b/.github/workflows/docker_publish.yaml
@@ -77,13 +77,13 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.1.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v3.12.0
 
       - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v3.7.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -104,7 +104,7 @@ jobs:
           echo "tags=${TAGS}" >> $GITHUB_OUTPUT
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v6.19.2
         with:
           context: .
           file: ./Dockerfile
@@ -125,7 +125,7 @@ jobs:
 
     steps:
       - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v3.7.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
diff --git a/.github/workflows/era_replay.yml b/.github/workflows/era_replay.yml
index 3a868d7b5..14b48d0fa 100644
--- a/.github/workflows/era_replay.yml
+++ b/.github/workflows/era_replay.yml
@@ -166,7 +166,7 @@ jobs:
 
       - name: Upload report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: era-replay-${{ matrix.network }}-${{ strategy.job-index }}
           path: ${{ runner.temp }}/report-*.json
@@ -178,7 +178,7 @@ jobs:
     if: failure() && github.event_name == 'push'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
 
       - name: Find the failing entries
         id: failed
diff --git a/.github/workflows/kurtosis_assertoor.yml b/.github/workflows/kurtosis_assertoor.yml
index 2e53fc8e4..fb1e1e01c 100644
--- a/.github/workflows/kurtosis_assertoor.yml
+++ b/.github/workflows/kurtosis_assertoor.yml
@@ -84,10 +84,10 @@ jobs:
     outputs:
       failed: ${{ steps.collect.outputs.failed }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
 
       - name: Free up disk space
-        uses: ./.github/actions/free-disk
+        uses: $/.github/actions/free-disk
 
       - name: Install kurtosis
         run: |
@@ -158,7 +158,7 @@ jobs:
 
       - name: Upload the dump and results
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: enclave-dump-${{ github.run_id }}
           path: ${{ runner.temp }}/dump
@@ -174,7 +174,7 @@ jobs:
     if: failure() && github.event_name == 'push'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
 
       - name: Build Slack payload
         # Values go through the environment and the JSON is built with jq, as in
diff --git a/.github/workflows/pr-main_mdbook.yml b/.github/workflows/pr-main_mdbook.yml
index 8ffde65b3..eae915960 100644
--- a/.github/workflows/pr-main_mdbook.yml
+++ b/.github/workflows/pr-main_mdbook.yml
@@ -32,10 +32,10 @@ jobs:
       group: ${{ github.workflow }}-build-${{ github.ref }}
       cancel-in-progress: true
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
 
       - name: Setup mdBook
-        uses: peaceiris/actions-mdbook@v2
+        uses: peaceiris/actions-mdbook@v2.0.0
         with:
           mdbook-version: "0.5.2"
 
@@ -45,7 +45,7 @@ jobs:
           toolchain: stable
 
       - name: Cache cargo install
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@v2.9.3
         with:
           cache-targets: false
 
@@ -59,7 +59,7 @@ jobs:
 
       - name: Upload docs artifact
         if: ${{ github.ref == 'refs/heads/main' }}
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: docs
           path: book/html
@@ -73,10 +73,10 @@ jobs:
     runs-on: ubuntu-latest
     needs: build
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
 
       - name: Check links
-        uses: lycheeverse/lychee-action@v2
+        uses: lycheeverse/lychee-action@v2.9.0
         with:
           # eprint.iacr.org returns 403 to non-browser User-Agents (anti-bot
           # protection on the IACR preprint server); the URLs themselves are
@@ -102,13 +102,13 @@ jobs:
       cancel-in-progress: false
     steps:
       - name: Download docs artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@v8.0.2
         with:
           name: docs
           path: book/html
 
       - name: Deploy to GitHub Pages
-        uses: peaceiris/actions-gh-pages@v4
+        uses: peaceiris/actions-gh-pages@v4.1.0
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: book/html
diff --git a/.github/workflows/pr_lint_gha.yaml b/.github/workflows/pr_lint_gha.yaml
index 5d12ec868..841b03e4f 100644
--- a/.github/workflows/pr_lint_gha.yaml
+++ b/.github/workflows/pr_lint_gha.yaml
@@ -20,10 +20,12 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
 
+      # Script pinned to a commit and binary to a release, so lint results change only with this file.
       - name: Install actionlint
-        run: bash <(curl -s https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
+        run: bash <(curl -sSfL https://raw.githubusercontent.com/rhysd/actionlint/914e7df21a07ef503a81201c76d2b11c789d3fca/scripts/download-actionlint.bash) 1.7.12
 
+      # actionlint does not parse the lockfile's `uses: $/...` same-repo form yet (rhysd/actionlint#711).
       - name: Run actionlint
-        run: ./actionlint -ignore SC2086
+        run: ./actionlint -ignore SC2086 -ignore 'specifying action "\$/'
diff --git a/.github/workflows/pr_lint_license.yaml b/.github/workflows/pr_lint_license.yaml
index 51cd60dc2..7dd7909f5 100644
--- a/.github/workflows/pr_lint_license.yaml
+++ b/.github/workflows/pr_lint_license.yaml
@@ -21,7 +21,7 @@ jobs:
     name: Verify License
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v6.1.0
 
       - name: Check LICENSE file exists
         run: |
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 301940d69..cc55b5fb9 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -64,7 +64,7 @@ jobs:
       candidate: ${{ steps.meta.outputs.candidate }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.1.0
 
       - name: Resolve tags, channel and version
         id: meta
@@ -148,21 +148,21 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.1.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v3.12.0
 
       - name: Log in to the Container registry
         if: needs.meta.outputs.publish == 'true'
-        uses: docker/login-action@v3
+        uses: docker/login-action@v3.7.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build and push Docker image
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v6.19.2
         with:
           context: .
           file: ./Dockerfile
@@ -189,7 +189,7 @@ jobs:
 
     steps:
       - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v3.7.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -238,7 +238,7 @@ jobs:
 
     steps:
       - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v3.7.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -256,7 +256,7 @@ jobs:
           echo "digest=$digest" >> "$GITHUB_OUTPUT"
 
       - name: Attest build provenance
-        uses: actions/attest@v4
+        uses: actions/attest@v4.2.2
         with:
           subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           subject-digest: ${{ steps.image.outputs.digest }}
@@ -280,7 +280,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.1.0
 
       - name: Setup Rust
         uses: dtolnay/rust-toolchain@master
@@ -306,7 +306,7 @@ jobs:
           "dist/ethlambda-${{ matrix.target.name }}" --version
 
       - name: Upload binary
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: ethlambda-${{ matrix.target.name }}
           path: dist/ethlambda-${{ matrix.target.name }}
@@ -325,7 +325,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@v6.1.0
         with:
           fetch-depth: 0
 
@@ -350,7 +350,7 @@ jobs:
       - name: Generate changelog
         id: changelog
         if: steps.previous.outputs.base != ''
-        uses: requarks/changelog-action@v1
+        uses: requarks/changelog-action@v1.10.3
         with:
           token: ${{ github.token }}
           fromTag: ${{ github.sha }}
@@ -396,7 +396,7 @@ jobs:
       # named `<owner>~<repo>~<id>.dockerbuild`, which download-artifact cannot
       # extract.
       - name: Download binaries
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@v8.0.2
         with:
           path: dist
           pattern: ethlambda-*
@@ -411,7 +411,7 @@ jobs:
       # Not in a dry run: an attestation is published the moment it is made.
       - name: Attest build provenance
         if: needs.meta.outputs.publish == 'true'
-        uses: actions/attest@v4
+        uses: actions/attest@v4.2.2
         with:
           subject-checksums: dist/SHA256SUMS
 
@@ -486,7 +486,7 @@ jobs:
 
       - name: Upload the release assets
         if: needs.meta.outputs.publish != 'true'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@v7.0.2
         with:
           name: dry-run-release-assets
           path: dist
diff --git a/.github/workflows/release_promote.yaml b/.github/workflows/release_promote.yaml
index 75f2061f4..909e7f18c 100644
--- a/.github/workflows/release_promote.yaml
+++ b/.github/workflows/release_promote.yaml
@@ -110,14 +110,14 @@ jobs:
       VERSION: ${{ needs.resolve.outputs.version }}
     steps:
       - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v3.7.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v3.12.0
 
       - name: Check the candidate image exists
         run: |
@@ -148,7 +148,7 @@ jobs:
           echo "digest=$digest" >> "$GITHUB_OUTPUT"
 
       - name: Attest build provenance
-        uses: actions/attest@v4
+        uses: actions/attest@v4.2.2
         with:
           subject-name: ${{ env.IMAGE }}
           subject-digest: ${{ steps.image.outputs.digest }}
@@ -166,7 +166,7 @@ jobs:
       VERSION: ${{ needs.resolve.outputs.version }}
     steps:
       - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v3.7.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -214,7 +214,7 @@ jobs:
       RELEASE_TAG: ${{ github.event.release.tag_name }}
     steps:
       - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@v3.7.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
diff --git a/.github/workflows/verify-lockfile.yml b/.github/workflows/verify-lockfile.yml
new file mode 100644
index 000000000..a64f86427
--- /dev/null
+++ b/.github/workflows/verify-lockfile.yml
@@ -0,0 +1,27 @@
+# Fails when .github/workflows/actions.lock is out of sync with the
+# workflows or a locked pin no longer verifies upstream.
+
+name: verify-lockfile
+
+on:
+  pull_request:
+  merge_group:
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    runs-on: ubuntu-latest
+    env:
+      GH_TOKEN: ${{ github.token }}
+    steps:
+      - uses: actions/checkout@v6.1.0
+        with:
+          persist-credentials: false
+      - run: gh extension install github/gh-actions-lock --pin v0.4.0
+      - run: gh actions-lock --verify
+