diff --git a/.github/workflows/build-and-test.yaml b/.github/workflows/build-and-test.yaml
index 1da63e59e..f5ddbcc48 100644
--- a/.github/workflows/build-and-test.yaml
+++ b/.github/workflows/build-and-test.yaml
@@ -10,13 +10,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v5.1.0
 
       - name: Setup JDK 11
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.7.0
         with:
           distribution: 'temurin'
-          java-version: '11'
+          java-version: '11.0.32+9'
 
       - name: Build and Test Core Packages
         run: ./gradlew clean build
@@ -25,13 +25,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v5.1.0
 
       - name: Setup JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.7.0
         with:
           distribution: 'temurin'
-          java-version: '17'
+          java-version: '17.0.21+9'
 
       - name: Build and Test Exemplar
         run: |
diff --git a/.github/workflows/generate-ref-docs.yml b/.github/workflows/generate-ref-docs.yml
index 3892b1c05..6b09f2c09 100644
--- a/.github/workflows/generate-ref-docs.yml
+++ b/.github/workflows/generate-ref-docs.yml
@@ -24,17 +24,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v5.1.0
         with:
           ref: ${{ inputs.ref }}
 
       - name: Setup java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.7.0
         with:
           distribution: 'corretto'
           java-version: '21'
 
-      - uses: gradle/actions/setup-gradle@v4
+      - uses: gradle/actions/setup-gradle@v4.4.4
         with:
           gradle-version: "8.13"
 
@@ -96,7 +96,7 @@ jobs:
         run: mv -v ${{ runner.temp }}/${{ env.NEW_DOCS_VERSION }}/* .
 
       - name: Create Pull Request
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@v7.0.11
         with:
           token: ${{ secrets.GITHUB_PAT }}
           commit-message: "chore: publishing docs for version ${{ env.NEW_DOCS_VERSION }}"
diff --git a/.github/workflows/manual-release.yml b/.github/workflows/manual-release.yml
index 69a5d14fb..5d8ac3f32 100644
--- a/.github/workflows/manual-release.yml
+++ b/.github/workflows/manual-release.yml
@@ -22,15 +22,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v5.1.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Setup JDK 11
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.7.0
         with:
           distribution: 'temurin'
-          java-version: '11'
+          java-version: '11.0.32+9'
 
       - name: Build and Test
         run: ./gradlew clean build
diff --git a/.github/workflows/pr-auto-approve.yaml b/.github/workflows/pr-auto-approve.yaml
index 99bdeaf2b..25aaca941 100644
--- a/.github/workflows/pr-auto-approve.yaml
+++ b/.github/workflows/pr-auto-approve.yaml
@@ -10,7 +10,7 @@ jobs:
     if: github.actor == 'dependabot[bot]' || github.actor == 'renovate[bot]'
     steps:
       - name: Provide first approval
-        uses: hmarr/auto-approve-action@v4
+        uses: hmarr/auto-approve-action@v4.0.0
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           review-message: "Renovate and Dependabot PRs are automatically approved. Still requires human review."
diff --git a/.github/workflows/pr-title-check.yml b/.github/workflows/pr-title-check.yml
index 72b598c2d..dec8e1ec6 100644
--- a/.github/workflows/pr-title-check.yml
+++ b/.github/workflows/pr-title-check.yml
@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check PR Title for Conventional Commits
-        uses: amannn/action-semantic-pull-request@v6
+        uses: amannn/action-semantic-pull-request@v6.1.1
         with:
           types: |
             feat
diff --git a/.github/workflows/snapshot-publish.yml b/.github/workflows/snapshot-publish.yml
index adeec1cff..896b96aba 100644
--- a/.github/workflows/snapshot-publish.yml
+++ b/.github/workflows/snapshot-publish.yml
@@ -12,15 +12,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@v5.1.0
         with:
           ref: ${{ inputs.branch }}
 
       - name: Set Up JDK
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.7.0
         with:
           distribution: 'temurin'
-          java-version: '17'
+          java-version: '17.0.21+9'
 
       - name: Publish Snapshots
         env: