diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
new file mode 100644
index 00000000..01bf3e59
--- /dev/null
+++ b/.github/workflows/actions.lock
@@ -0,0 +1,97 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/ci.yml':
+        - 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5'
+        - 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
+        - 'actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd'
+        - 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+    '.github/workflows/publish-npm.yml':
+        - 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
+        - 'actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610'
+    '.github/workflows/release-doctor.yml':
+        - 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
+    '.github/workflows/release-please.yml':
+        - 'actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547'
+        - 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+        - 'pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1'
+    '.github/workflows/semgrep.yml': []
+    '.github/workflows/stlc-promote.yml':
+        - 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
+        - 'actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547'
+    '.github/workflows/stlc-sync.yml':
+        - 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd'
+    '.github/workflows/update-docs.yml':
+        - 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5'
+        - 'actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547'
+        - 'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093'
+        - 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+        - 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02'
+        - 'kernel/security-workflows@4144994f1d6977e07ef5a5832599ee4faaae9550'
+    '.github/workflows/update-mcp-coverage.yml':
+        - 'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5'
+        - 'actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547'
+        - 'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093'
+        - 'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020'
+        - 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02'
+        - 'kernel/security-workflows@4144994f1d6977e07ef5a5832599ee4faaae9550'
+        - 'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6'
+    '.github/workflows/vuln-remediation.yml': []
+dependencies:
+    'actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5':
+        ref: 'v4.3.1'
+        commit: 'sha1-34e114876b0b11c390a56381ad16ebd13914f8d5'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd':
+        ref: 'v6.0.2'
+        commit: 'sha1-de0fac2e4500dabe0009e67214ff5f5447ce83dd'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547':
+        ref: 'v1.12.0'
+        commit: 'sha1-d72941d797fd3113feb6b93fd0dec494b13a2547'
+        owner_id: 44036562
+        repo_id: 642580244
+    'actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093':
+        ref: 'v4.3.0'
+        commit: 'sha1-d3f86a106a0bac45b974a628896c90dbdf5c8093'
+        owner_id: 44036562
+        repo_id: 192626254
+    'actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd':
+        ref: 'v8.0.0'
+        commit: 'sha1-ed597411d8f924073f98dfc5c65a23a2325f34cd'
+        owner_id: 44036562
+        repo_id: 205262760
+    'actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610':
+        ref: 'v3.9.1'
+        commit: 'sha1-3235b876344d2a9aa001b8d1453c930bba69e610'
+        owner_id: 44036562
+        repo_id: 189476904
+    'actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020':
+        ref: 'v4.4.0'
+        commit: 'sha1-49933ea5288caeca8642d1e84afbd3f7d6820020'
+        owner_id: 44036562
+        repo_id: 189476904
+    'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02':
+        ref: 'v4.6.2'
+        commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
+        owner_id: 44036562
+        repo_id: 192625955
+    'kernel/security-workflows@4144994f1d6977e07ef5a5832599ee4faaae9550':
+        ref: 'main'
+        commit: 'sha1-4144994f1d6977e07ef5a5832599ee4faaae9550'
+        owner_id: 194616459
+        repo_id: 1207196574
+    'oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6':
+        ref: 'v2.2.0'
+        commit: 'sha1-0c5077e51419868618aeaa5fe8019c62421857d6'
+        owner_id: 108928776
+        repo_id: 512644635
+    'pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1':
+        ref: 'v4.3.0'
+        commit: 'sha1-b906affcce14559ad1aafd4ab0e942779e9f58b1'
+        owner_id: 21320719
+        repo_id: 262289747
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index e69a7175..b77e1e4a 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -41,7 +41,7 @@ jobs:
           node-version: '22'
 
       - name: Set up pnpm
-        uses: pnpm/action-setup@f40ffcd9367d9f12939873eb1018b921a783ffaa # v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
         with:
           version: '9.11.0'
           run_install: false