diff --git a/.github/workflows/build_archives.yaml b/.github/workflows/build_archives.yaml
index 12b30a7b..cbf019c9 100644
--- a/.github/workflows/build_archives.yaml
+++ b/.github/workflows/build_archives.yaml
@@ -12,12 +12,12 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           token: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }}
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
 
diff --git a/.github/workflows/lint_and_test.yaml b/.github/workflows/lint_and_test.yaml
index 5093fcb6..940ef11e 100644
--- a/.github/workflows/lint_and_test.yaml
+++ b/.github/workflows/lint_and_test.yaml
@@ -35,10 +35,10 @@ jobs:
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
 
diff --git a/.github/workflows/test_dockerfile_builds.yaml b/.github/workflows/test_dockerfile_builds.yaml
index 26474e98..972fdfe7 100644
--- a/.github/workflows/test_dockerfile_builds.yaml
+++ b/.github/workflows/test_dockerfile_builds.yaml
@@ -17,7 +17,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Free disk space
         # Only the fast rm -rf part of the old "maximize disk space" step — the
diff --git a/.github/workflows/test_llm_ai_node_templates.yaml b/.github/workflows/test_llm_ai_node_templates.yaml
index 509f410b..f6f98f5c 100644
--- a/.github/workflows/test_llm_ai_node_templates.yaml
+++ b/.github/workflows/test_llm_ai_node_templates.yaml
@@ -21,10 +21,10 @@ jobs:
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node-version }}
 
diff --git a/.github/workflows/test_llm_ai_python_templates.yaml b/.github/workflows/test_llm_ai_python_templates.yaml
index fb2d98a1..fddfe5d6 100644
--- a/.github/workflows/test_llm_ai_python_templates.yaml
+++ b/.github/workflows/test_llm_ai_python_templates.yaml
@@ -16,10 +16,10 @@ jobs:
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
 
@@ -27,7 +27,7 @@ jobs:
         uses: apify/workflows/pnpm-install@v0.46.0
 
       - name: Setup Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
           cache: pip
diff --git a/.github/workflows/test_node_templates.yaml b/.github/workflows/test_node_templates.yaml
index e7cd9c62..71c1a9db 100644
--- a/.github/workflows/test_node_templates.yaml
+++ b/.github/workflows/test_node_templates.yaml
@@ -29,10 +29,10 @@ jobs:
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node-version }}
 
diff --git a/.github/workflows/test_python_templates.yaml b/.github/workflows/test_python_templates.yaml
index 3fa341ef..9b874f1b 100644
--- a/.github/workflows/test_python_templates.yaml
+++ b/.github/workflows/test_python_templates.yaml
@@ -18,10 +18,10 @@ jobs:
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
 
@@ -32,7 +32,7 @@ jobs:
         run: pnpm exec playwright install chromium --with-deps
 
       - name: Setup Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ matrix.python-version }}
           cache: pip
@@ -40,7 +40,7 @@ jobs:
 
       # For uv-based templates (e.g. python-uv); uv provides its own Python from .python-version.
       - name: Setup uv
-        uses: astral-sh/setup-uv@v8.3.2
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
 
       - name: Install Chrome and Chromedriver
         # Use pnpm dlx instead of npx — npx is the npm CLI and trips
diff --git a/.github/workflows/update-new-issue.yaml b/.github/workflows/update-new-issue.yaml
index 08d007a9..60959be7 100644
--- a/.github/workflows/update-new-issue.yaml
+++ b/.github/workflows/update-new-issue.yaml
@@ -14,7 +14,7 @@ jobs:
 
     steps:
       # Add the "t-builders" label to all new issues
-      - uses: actions/github-script@v9
+      - uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             github.rest.issues.addLabels({
diff --git a/.github/workflows/update-templates.yml b/.github/workflows/update-templates.yml
index cdb134e8..0465d9e5 100644
--- a/.github/workflows/update-templates.yml
+++ b/.github/workflows/update-templates.yml
@@ -41,13 +41,13 @@ jobs:
           echo "BASE_IMAGE_FORMATTED=$(echo '${{ env.BASE_IMAGE_RAW }}' | sed 's/,/, /g')" >> $GITHUB_OUTPUT
 
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           token: ${{ secrets.APIFY_SERVICE_ACCOUNT_GITHUB_TOKEN }}
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: 24