diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9d56689..e93feda 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -121,7 +121,7 @@ jobs:
     name: rivet validate (artifact spine)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           path: jess
       # gale + relay externals are declared as git-links in rivet.yaml (pinned in
@@ -329,7 +329,7 @@ jobs:
         os: [ubuntu-latest, macos-14]
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: build + self-test
         working-directory: tools/bench/with-device
         run: |
@@ -378,7 +378,7 @@ jobs:
     name: spar model (Pixhawk 6X-RT)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Fetch pinned spar release
         run: |
           set -euo pipefail
@@ -410,7 +410,7 @@ jobs:
     name: mav_bench oracle (REQ-PIX-010)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: mav_bench oracle over the committed sample
         run: python3 tools/bench/test_mav_bench.py
 
@@ -420,7 +420,7 @@ jobs:
     name: Renode RT1176 smoke (REQ-PIX-005)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Install Renode (pinned portable)
         run: |
           set -euo pipefail
@@ -552,7 +552,7 @@ jobs:
     name: on-target cascade oracles (TEST-PIX-032 / TEST-PIX-033)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: arm-none-eabi toolchain
         run: |
           set -euo pipefail
@@ -846,7 +846,7 @@ jobs:
     name: component oracles (composition, dispatch, timer)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: rust wasm32 target
         run: rustup target add wasm32-unknown-unknown
       - name: wasm-tools / wac / wasmtime (pinned to the versions used locally)
@@ -931,7 +931,7 @@ jobs:
     name: scry sound-analysis (REQ-PIX-018 / TEST-PIX-022)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       - name: Fetch pinned meld release
         run: |
           set -euo pipefail
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 956296a..b51e56b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -54,7 +54,7 @@ jobs:
           - { os: macos-14,        target: aarch64-apple-darwin }
           - { os: macos-14,        target: x86_64-apple-darwin }
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           ref: ${{ inputs.tag || github.ref }}
       - name: rust target
@@ -85,7 +85,7 @@ jobs:
           cp ../devices.yaml "/tmp/pkg/$NAME/devices.yaml.example"
           tar czf "/tmp/${NAME}.tar.gz" -C /tmp/pkg "$NAME"
           ls -l "/tmp/${NAME}.tar.gz"
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7
         with:
           name: pkg-${{ matrix.target }}
           path: /tmp/with-device-*.tar.gz
@@ -105,7 +105,7 @@ jobs:
       contents: read
       actions: read
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           ref: ${{ inputs.tag || github.ref }}
       - name: require ci.yml's model step to have succeeded on this exact sha
@@ -126,10 +126,10 @@ jobs:
       id-token: write
       attestations: write
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           ref: ${{ inputs.tag || github.ref }}
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8
         with:
           pattern: pkg-*
           path: artifacts
@@ -200,7 +200,7 @@ jobs:
       # An in-toto SLSA v1 statement per archive, signed keyless via Sigstore and recorded in
       # Rekor. Verify with `gh attestation verify <file> --repo pulseengine/jess`.
       - name: Generate SLSA build provenance
-        uses: actions/attest-build-provenance@v4
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4
         with:
           subject-path: "release-assets/*.tar.gz"
 
@@ -214,7 +214,7 @@ jobs:
       #     --bundle SHA256SUMS.txt.cosign.bundle \
       #     SHA256SUMS.txt
       - name: Install cosign
-        uses: sigstore/cosign-installer@v3
+        uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
         with:
           cosign-release: 'v2.4.1'
       - name: Sign SHA256SUMS with cosign (keyless OIDC)
@@ -275,7 +275,7 @@ jobs:
       id-token: write
     steps:
       - name: Install cosign
-        uses: sigstore/cosign-installer@v3
+        uses: sigstore/cosign-installer@398d4b0eeef1380460a10c8013a76f728fb906ac # v3
         with:
           cosign-release: 'v2.4.1'
       - name: Download the published release and verify it