diff --git a/.github/workflows/check_cirrus_cron.yml b/.github/workflows/check_cirrus_cron.yml
index 60ee8d1c35..bd69c47084 100644
--- a/.github/workflows/check_cirrus_cron.yml
+++ b/.github/workflows/check_cirrus_cron.yml
@@ -61,7 +61,7 @@ jobs:
             - if: steps.cron.outputs.failures > 0
               name: Send failure notification e-mail
               # Ref: https://github.com/dawidd6/action-send-mail
-              uses: dawidd6/action-send-mail@v3.12.0
+              uses: dawidd6/action-send-mail@2cea9617b09d79a095af21254fbcb7ae95903dde # v3.12.0
               with:
                 server_address: ${{secrets.ACTION_MAIL_SERVER}}
                 server_port: 465
@@ -80,7 +80,7 @@ jobs:
 
             - if: failure()
               name: Send error notification e-mail
-              uses: dawidd6/action-send-mail@v3.12.0
+              uses: dawidd6/action-send-mail@2cea9617b09d79a095af21254fbcb7ae95903dde # v3.12.0
               with:
                 server_address: ${{secrets.ACTION_MAIL_SERVER}}
                 server_port: 465
diff --git a/.github/workflows/issue_pr_lock.yml b/.github/workflows/issue_pr_lock.yml
index a5ba2f98d1..bb1d5a4c60 100644
--- a/.github/workflows/issue_pr_lock.yml
+++ b/.github/workflows/issue_pr_lock.yml
@@ -61,7 +61,7 @@ jobs:
           private-key: ${{ secrets.STALE_LOCKING_APP_PRIVATE_KEY }}
 
       # Ref: https://github.com/dessant/lock-threads#usage
-      - uses: dessant/lock-threads@v5
+      - uses: dessant/lock-threads@1bf7ec25051fe7c00bdd17e6a7cf3d7bfb7dc771 # v5.0.1
         with:
           github-token: '${{ steps.generate-token.outputs.token }}'
           process-only: 'issues, prs'
@@ -73,7 +73,7 @@ jobs:
           log-output: true
       - if: failure()
         name: Send job failure notification e-mail
-        uses: dawidd6/action-send-mail@v3.12.0
+        uses: dawidd6/action-send-mail@2cea9617b09d79a095af21254fbcb7ae95903dde # v3.12.0
         with:
           server_address: ${{secrets.ACTION_MAIL_SERVER}}
           server_port: 465
diff --git a/.github/workflows/machine-os-pr.yml b/.github/workflows/machine-os-pr.yml
index 9667ab0e86..c6455e898c 100644
--- a/.github/workflows/machine-os-pr.yml
+++ b/.github/workflows/machine-os-pr.yml
@@ -144,6 +144,6 @@ jobs:
 
       - name: Comment PR link
         if: steps.getversion.outputs.update == 'true' && steps.checkpr.outputs.openpr == 'true'
-        uses: thollander/actions-comment-pull-request@v3
+        uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
         with:
           message: "Building images at: ${{ steps.pr.outputs.uri }}"
diff --git a/.github/workflows/release-artifacts.yml b/.github/workflows/release-artifacts.yml
index 68c0eaee48..7040648261 100644
--- a/.github/workflows/release-artifacts.yml
+++ b/.github/workflows/release-artifacts.yml
@@ -235,7 +235,7 @@ jobs:
 
       - name: Send release notification e-mail
         # Ref: https://github.com/dawidd6/action-send-mail
-        uses: dawidd6/action-send-mail@v3.12.0
+        uses: dawidd6/action-send-mail@2cea9617b09d79a095af21254fbcb7ae95903dde # v3.12.0
         with:
           server_address: ${{secrets.ACTION_MAIL_SERVER}}
           server_port: 465
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 825ced584f..d88ea81b6c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -179,7 +179,7 @@ jobs:
         echo "TENANT_ID=${{secrets.AZ_TENANT_ID}}" | Out-File -FilePath $env:GITHUB_ENV -Append
         echo "CLIENT_SECRET=${{secrets.AZ_CLIENT_SECRET}}" | Out-File -FilePath $env:GITHUB_ENV -Append
     - name: Pandoc Setup
-      uses: r-lib/actions/setup-pandoc@v2
+      uses: r-lib/actions/setup-pandoc@6f6e5bc62fba3a704f74e7ad7ef7676c5c6a2590 # v2.11.4
       with:
         pandoc-version: '3.1.11'
     # Note: Windows assigns a UUID to the installer at build time, it's assumed
@@ -359,7 +359,7 @@ jobs:
         run: cat email_body.txt
       - name: Send release notification e-mail
         # Ref: https://github.com/dawidd6/action-send-mail
-        uses: dawidd6/action-send-mail@v3.12.0
+        uses: dawidd6/action-send-mail@2cea9617b09d79a095af21254fbcb7ae95903dde # v3.12.0
         with:
           server_address: ${{secrets.ACTION_MAIL_SERVER}}
           server_port: 465
diff --git a/.github/workflows/upload-win-installer.yml b/.github/workflows/upload-win-installer.yml
index edf5a26950..d7a8b42099 100644
--- a/.github/workflows/upload-win-installer.yml
+++ b/.github/workflows/upload-win-installer.yml
@@ -101,7 +101,7 @@ jobs:
         echo "TENANT_ID=${{secrets.AZ_TENANT_ID}}" | Out-File -FilePath $env:GITHUB_ENV -Append
         echo "CLIENT_SECRET=${{secrets.AZ_CLIENT_SECRET}}" | Out-File -FilePath $env:GITHUB_ENV -Append
     - name: Pandoc Setup
-      uses: r-lib/actions/setup-pandoc@v2
+      uses: r-lib/actions/setup-pandoc@6f6e5bc62fba3a704f74e7ad7ef7676c5c6a2590 # v2.11.4
       with:
         pandoc-version: '3.1.11'
     - name: Build