diff --git a/.github/workflows/add-help-wanted.yml b/.github/workflows/add-help-wanted.yml
index 24418143..180ccfd1 100644
--- a/.github/workflows/add-help-wanted.yml
+++ b/.github/workflows/add-help-wanted.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Add label based on comment
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd
         with:
           script: |
             const comment = context.payload.comment.body.trim().toLowerCase();
diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index c048c0d6..f5b14129 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -9,8 +9,8 @@ jobs:
     runs-on: ubuntu-latest
     name: CI Checks
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-go@v6
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
+      - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c
         with:
           go-version: "1.24.5"
       - name: Lint
diff --git a/.github/workflows/dco.yaml b/.github/workflows/dco.yaml
index b6859e79..f95b5db2 100644
--- a/.github/workflows/dco.yaml
+++ b/.github/workflows/dco.yaml
@@ -12,9 +12,9 @@ jobs:
     # This 'if' condition will only run the job if the actor is not dependabot[bot]
     if: github.actor != 'dependabot[bot]'
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
       - name: Set up Python 3.x
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548
         with:
           python-version: '3.x'
       - name: Check DCO
diff --git a/.github/workflows/feedback.yaml b/.github/workflows/feedback.yaml
index 73cc6efa..24ee2b9b 100644
--- a/.github/workflows/feedback.yaml
+++ b/.github/workflows/feedback.yaml
@@ -15,7 +15,7 @@ jobs:
 
         steps:
             - name: Comment feedback request
-              uses: peter-evans/create-or-update-comment@23ff15729ef2fc348714a3bb66d2f655ca9066f2
+              uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9
               with:
                   issue-number: ${{ github.event.pull_request.number }}
                   body: |
diff --git a/.github/workflows/goreleaser.yml b/.github/workflows/goreleaser.yml
index 0f5fbfa3..a8784051 100644
--- a/.github/workflows/goreleaser.yml
+++ b/.github/workflows/goreleaser.yml
@@ -20,11 +20,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v5
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
       with:
         fetch-depth: 0
 
-    - uses: actions/setup-go@v6
+    - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c
       with:
         go-version: v1.23
 
@@ -35,7 +35,7 @@ jobs:
       run: echo LDFLAGS="$(make ldflags)" >> $GITHUB_ENV
 
     - name: Run GoReleaser on tag
-      uses: goreleaser/goreleaser-action@v6
+      uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a
       with:
         distribution: goreleaser
         version: 2
@@ -47,12 +47,12 @@ jobs:
         EMAIL: ${{ github.actor}}@users.noreply.github.com
 
     - name: Set up Helm
-      uses: azure/setup-helm@v4
+      uses: azure/setup-helm@1a275c3b69536ee54be43f2070a358922e12c8d4
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Login to registry
-      uses: docker/login-action@v3
+      uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef
       with:
         registry: ${{ env.REGISTRY }}
         username: ${{ github.actor }}
diff --git a/.github/workflows/spellcheck_action.yml b/.github/workflows/spellcheck_action.yml
index 88c1545a..0af84cba 100644
--- a/.github/workflows/spellcheck_action.yml
+++ b/.github/workflows/spellcheck_action.yml
@@ -17,8 +17,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     # The checkout step
-    - uses: actions/checkout@v5
-    - uses: rojopolis/spellcheck-github-actions@v0
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
+    - uses: rojopolis/spellcheck-github-actions@16d0338a5a3b5e3111a078029fb9a07a8125053d
       name: Spellcheck
       with:
         config_path: .github/spellcheck/.spellcheck.yml # put path to configuration file here
diff --git a/.github/workflows/test-e2e.yaml b/.github/workflows/test-e2e.yaml
index 7289c08e..daaf3016 100644
--- a/.github/workflows/test-e2e.yaml
+++ b/.github/workflows/test-e2e.yaml
@@ -19,19 +19,19 @@ jobs:
     name: Test ControlPlane lifecycle management
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
         with:
           fetch-depth: 0
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c
         with:
           go-version: v1.24.5
           cache: true
 
-      - uses: ko-build/setup-ko@v0.9
+      - uses: ko-build/setup-ko@d006021bd0c28d1ce33a07e7943d48b079944c8d
 
       - name: Install kubectl
-        uses: azure/setup-kubectl@v4
+        uses: azure/setup-kubectl@776406bce94f63e41d621b960d78ee25c8b76ede
         id: install
 
       - name: Run test