diff --git a/.github/actions/notices_generation/action.yml b/.github/actions/notices_generation/action.yml
index b47920ffe6e..b8005b79e48 100644
--- a/.github/actions/notices_generation/action.yml
+++ b/.github/actions/notices_generation/action.yml
@@ -40,7 +40,7 @@ runs:
       fi
     shell: bash
   - name: Upload artifacts
-    uses: actions/upload-artifact@v4
+    uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
     with:
       name: notices
       path: ${{ inputs.notices-path }}
diff --git a/.github/workflows/analytics.yml b/.github/workflows/analytics.yml
index 6e835ee1eff..cbc64001f30 100644
--- a/.github/workflows/analytics.yml
+++ b/.github/workflows/analytics.yml
@@ -33,7 +33,7 @@ jobs:
     runs-on: ${{ matrix.os }}
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Setup Bundler
       run: scripts/setup_bundler.sh
diff --git a/.github/workflows/api_diff_report.yml b/.github/workflows/api_diff_report.yml
index 3ffdcd09eee..4d7919e0a7b 100644
--- a/.github/workflows/api_diff_report.yml
+++ b/.github/workflows/api_diff_report.yml
@@ -21,7 +21,7 @@ jobs:
 
     steps:
       - name: Checkout PR branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           fetch-depth: 2
 
@@ -34,7 +34,7 @@ jobs:
           echo "file_list=$(git diff --name-only -r HEAD^1 HEAD | tr '\n' ' ')" >> $GITHUB_OUTPUT
 
       - name: Setup python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
         with:
           python-version: '3.11'
 
@@ -82,7 +82,7 @@ jobs:
             --commit $GITHUB_SHA \
             --run_id ${{github.run_id}}
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         if: ${{ !cancelled() }}
         with:
           name: api_info_and_report
diff --git a/.github/workflows/archiving.yml b/.github/workflows/archiving.yml
index 92a8d05bacd..b7bfe7a94ef 100644
--- a/.github/workflows/archiving.yml
+++ b/.github/workflows/archiving.yml
@@ -28,7 +28,7 @@ jobs:
         # These need to be on a single line or else the formatting won't validate.
         pod: ["FirebaseAppDistribution", "FirebaseInAppMessaging", "FirebasePerformance"]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - name: Set Xcode version
       run: sudo xcode-select -s /Applications/Xcode_16.4.app
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
@@ -54,7 +54,7 @@ jobs:
         # These need to be on a single line or else the formatting won't validate.
         pod: ["FirebaseABTesting", "FirebaseAuth", "FirebaseCore", "FirebaseCrashlytics", "FirebaseDatabase", "FirebaseFirestore", "FirebaseFunctions", "FirebaseMessaging", "FirebaseRemoteConfig", "FirebaseStorage"]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - name: Set Xcode version
       run: sudo xcode-select -s /Applications/Xcode_16.4.app
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
diff --git a/.github/workflows/auth.yml b/.github/workflows/auth.yml
index 6fb04294279..045b7bd5d01 100644
--- a/.github/workflows/auth.yml
+++ b/.github/workflows/auth.yml
@@ -63,8 +63,8 @@ jobs:
       FIREBASECI_USE_LATEST_GOOGLEAPPMEASUREMENT: 1
     runs-on: macos-15
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/cache/restore@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+    - uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
       with:
         path: .build
         key: ${{ needs.spm.outputs.cache_key }}
diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index fb1fce668ce..ce7c4d6bacc 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -20,14 +20,14 @@ jobs:
     env:
       MINT_PATH: ${{ github.workspace }}/mint
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
       with:
         python-version: 3.11
 
     - name: Cache Mint packages
-      uses: actions/cache@v4
+      uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
       with:
         path: ${{ env.MINT_PATH }}
         key: ${{ runner.os }}-mint-${{ hashFiles('**/Mintfile') }}
diff --git a/.github/workflows/client_app.yml b/.github/workflows/client_app.yml
index 995ede3ebe3..de6a0614694 100644
--- a/.github/workflows/client_app.yml
+++ b/.github/workflows/client_app.yml
@@ -39,7 +39,7 @@ jobs:
             xcode: Xcode_16.4
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - name: Xcode
         run: sudo xcode-select -s /Applications/${{ matrix.xcode }}.app/Contents/Developer
       - name: Build Client App - ${{ matrix.platform }}
@@ -63,7 +63,7 @@ jobs:
               xcode: Xcode_16.4
       runs-on: ${{ matrix.os }}
       steps:
-        - uses: actions/checkout@v4
+        - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         - name: Xcode
           run: sudo xcode-select -s /Applications/${{ matrix.xcode }}.app/Contents/Developer
         - name: Build Client App - ${{ matrix.platform }}
@@ -83,7 +83,7 @@ jobs:
             xcode: Xcode_16.4
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
       - name: Setup Bundler
         run: scripts/setup_bundler.sh
diff --git a/.github/workflows/cocoapods-integration.yml b/.github/workflows/cocoapods-integration.yml
index 5a84001b6db..20ce3bc4739 100644
--- a/.github/workflows/cocoapods-integration.yml
+++ b/.github/workflows/cocoapods-integration.yml
@@ -22,7 +22,7 @@ jobs:
 
     runs-on: macos-15
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - name: Xcode
       run: sudo xcode-select -s /Applications/Xcode_16.4.app/Contents/Developer
     - name: Get realpath
diff --git a/.github/workflows/combine.yml b/.github/workflows/combine.yml
index e1bcb1ac9d0..e8c4f19175d 100644
--- a/.github/workflows/combine.yml
+++ b/.github/workflows/combine.yml
@@ -60,7 +60,7 @@ jobs:
         target: [iOS]
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
 
@@ -83,7 +83,7 @@ jobs:
       plist_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
     runs-on: macos-15
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Xcode
       run: sudo xcode-select -s /Applications/Xcode_16.4.app/Contents/Developer
diff --git a/.github/workflows/common.yml b/.github/workflows/common.yml
index 0830337b09f..6747df55e0c 100644
--- a/.github/workflows/common.yml
+++ b/.github/workflows/common.yml
@@ -71,7 +71,7 @@ jobs:
     outputs:
       cache_key: ${{ steps.generate_cache_key.outputs.cache_key }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - name: Xcode
         run: sudo xcode-select -s /Applications/Xcode_16.4.app/Contents/Developer
       - name: Generate Swift Package.resolved
@@ -82,7 +82,7 @@ jobs:
         run: |
           cache_key="${{ runner.os }}-spm-${{ hashFiles('**/Package.resolved') }}"
           echo "cache_key=${cache_key}" >> "$GITHUB_OUTPUT"
-      - uses: actions/cache/save@v4
+      - uses: actions/cache/save@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
         id: cache
         with:
           path: .build
@@ -108,8 +108,8 @@ jobs:
             platform: iOS
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/cache/restore@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+    - uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
       with:
         path: .build
         key: ${{needs.spm-package-resolved.outputs.cache_key}}
@@ -133,13 +133,13 @@ jobs:
             ${{ inputs.target }} \
             ${{ matrix.platform }} \
             ${{ (contains(inputs.buildonly_platforms, matrix.platform) || contains(inputs.buildonly_platforms, 'all')) && 'spmbuildonly' || 'spm' }}
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       if: ${{ failure() }}
       with:
         name: xcodebuild-logs-${{ inputs.target }}-${{ matrix.platform }}-${{ matrix.os }}-${{ matrix.xcode }}
         path: xcodebuild-*.log
         if-no-files-found: error
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       if: ${{ failure() }}
       with:
         name: xcresults-${{ inputs.target }}-${{ matrix.platform }}-${{ matrix.os }}-${{ matrix.xcode }}
diff --git a/.github/workflows/common_catalyst.yml b/.github/workflows/common_catalyst.yml
index aca98e27c82..41ebf53e223 100644
--- a/.github/workflows/common_catalyst.yml
+++ b/.github/workflows/common_catalyst.yml
@@ -29,7 +29,7 @@ jobs:
     if: (github.repository == 'firebase/firebase-ios-sdk' && github.event_name == 'schedule') || contains(fromJSON('["pull_request", "workflow_dispatch"]'), github.event_name)
     runs-on: macos-15
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Setup Bundler
       run: scripts/setup_bundler.sh
diff --git a/.github/workflows/common_cocoapods.yml b/.github/workflows/common_cocoapods.yml
index 79562cab290..ec6f8b12322 100644
--- a/.github/workflows/common_cocoapods.yml
+++ b/.github/workflows/common_cocoapods.yml
@@ -131,7 +131,7 @@ jobs:
             platform: iOS
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Setup Bundler
       run: scripts/setup_bundler.sh
diff --git a/.github/workflows/common_cocoapods_cron.yml b/.github/workflows/common_cocoapods_cron.yml
index ade13db13b5..e854fb872b1 100644
--- a/.github/workflows/common_cocoapods_cron.yml
+++ b/.github/workflows/common_cocoapods_cron.yml
@@ -64,7 +64,7 @@ jobs:
         flags: ${{ fromJson(inputs.flags) }}
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Setup Bundler
       run: scripts/setup_bundler.sh
diff --git a/.github/workflows/common_quickstart.yml b/.github/workflows/common_quickstart.yml
index 34698c38689..fd1a5b21593 100644
--- a/.github/workflows/common_quickstart.yml
+++ b/.github/workflows/common_quickstart.yml
@@ -70,7 +70,7 @@ jobs:
       QUICKSTART_BRANCH: ${{ inputs.quickstart_branch }}
     runs-on: macos-15
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Prereqs
       run: gem install xcpretty
@@ -103,7 +103,7 @@ jobs:
     - name: Remove data before upload.
       if: failure()
       run: scripts/remove_data.sh ${{ steps.lowercase_product.outputs.lowercase_product }}
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       if: failure()
       with:
         name: quickstart_artifacts_${{ steps.lowercase_product.outputs.lowercase_product }}
diff --git a/.github/workflows/common_quickstart_framework.yml b/.github/workflows/common_quickstart_framework.yml
index 51458eda1bb..f21606ee232 100644
--- a/.github/workflows/common_quickstart_framework.yml
+++ b/.github/workflows/common_quickstart_framework.yml
@@ -61,9 +61,9 @@ jobs:
       SCHEME: ${{ inputs.scheme }}
     runs-on: ${{ inputs.os }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - name: Get framework dir
-      uses: actions/download-artifact@v4.1.7
+      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
       with:
         name: ${{ inputs.artifact_name }}
         run-id: ${{ inputs.zip_run_id }}
@@ -90,7 +90,7 @@ jobs:
         retry_wait_seconds: 120
         command: ([ -z $plist_secret ] || scripts/test_quickstart_framework.sh "${SDK}" "${SCHEME}")
     # Failure sequence to upload artifact.
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       if: failure()
       with:
         name: quickstart_artifacts_${{ inputs.product }}_${{ inputs.artifact_name }}
diff --git a/.github/workflows/danger.yml b/.github/workflows/danger.yml
index ac7730cb1ad..dc3a0fe33b7 100644
--- a/.github/workflows/danger.yml
+++ b/.github/workflows/danger.yml
@@ -10,7 +10,7 @@ jobs:
   danger:
     runs-on: macos-14
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Setup Bundler
       run: scripts/setup_bundler.sh
diff --git a/.github/workflows/database.yml b/.github/workflows/database.yml
index 173816b36c0..9a213260520 100644
--- a/.github/workflows/database.yml
+++ b/.github/workflows/database.yml
@@ -55,7 +55,7 @@ jobs:
     if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'
     runs-on: macos-15
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Setup Bundler
       run: scripts/setup_bundler.sh
diff --git a/.github/workflows/firebase_app_check.yml b/.github/workflows/firebase_app_check.yml
index 2ce5eb62e90..c2d00f6b08f 100644
--- a/.github/workflows/firebase_app_check.yml
+++ b/.github/workflows/firebase_app_check.yml
@@ -54,7 +54,7 @@ jobs:
       matrix:
         diagnostic: [tsan, asan, ubsan]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - name: Xcode
       run: sudo xcode-select -s /Applications/Xcode_16.4.app/Contents/Developer
     - name: Initialize xcodebuild
@@ -63,7 +63,7 @@ jobs:
       run: scripts/third_party/travis/retry.sh ./scripts/build.sh FirebaseAppCheckUnit iOS spm ${{ matrix.diagnostic }}
     - name: Upload raw logs if failed
       if: ${{ failure() }}
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       with:
         name: failure-xcodebuild-raw-logs
         path: xcodebuild.log
diff --git a/.github/workflows/firebaseai.yml b/.github/workflows/firebaseai.yml
index 1f3cde4a26a..8cb532e1964 100644
--- a/.github/workflows/firebaseai.yml
+++ b/.github/workflows/firebaseai.yml
@@ -55,8 +55,8 @@ jobs:
       FIREBASECI_USE_LATEST_GOOGLEAPPMEASUREMENT: 1
       secrets_passphrase: ${{ secrets.GHASecretsGPGPassphrase1 }}
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/cache/restore@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+    - uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
       with:
         path: .build
         key: ${{ needs.spm.outputs.cache_key }}
@@ -64,7 +64,7 @@ jobs:
       run: scripts/repo.sh tests run --secrets ./scripts/secrets/AI.json --platforms ${{ matrix.target }} --xcode ${{ matrix.xcode }} AI
     - name: Upload xcodebuild logs
       if: failure()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       with:
         name: xcodebuild-${{ matrix.target }}-${{ matrix.os }}-${{ matrix.xcode }}.log
         path: xcodebuild-*.log
@@ -93,7 +93,7 @@ jobs:
     env:
       BRANCH_NAME: ${{ github.head_ref || github.ref_name || 'main' }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - name: Xcode
       run: sudo xcode-select -s /Applications/${{ matrix.xcode }}.app/Contents/Developer
     - name: Build Quickstart
diff --git a/.github/workflows/firebasepod.yml b/.github/workflows/firebasepod.yml
index eae29d4b54f..a26db4d9353 100644
--- a/.github/workflows/firebasepod.yml
+++ b/.github/workflows/firebasepod.yml
@@ -26,7 +26,7 @@ jobs:
     runs-on: macos-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Setup Bundler
       run: scripts/setup_bundler.sh
@@ -36,7 +36,7 @@ jobs:
       run: scripts/install_prereqs.sh FirebasePod iOS
     - name: Build
       run: scripts/build.sh FirebasePod iOS
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       if: ${{ failure() }}
       with:
         name: firebasepod-xcodebuild-build.log
diff --git a/.github/workflows/firestore-nightly.yml b/.github/workflows/firestore-nightly.yml
index 36beeadb4ac..9c0291bd1c5 100644
--- a/.github/workflows/firestore-nightly.yml
+++ b/.github/workflows/firestore-nightly.yml
@@ -25,9 +25,9 @@ jobs:
   check:
     runs-on: macos-14
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
       with:
         python-version: 3.11
 
@@ -52,10 +52,10 @@ jobs:
 
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
     - name: Prepare ccache
-      uses: actions/cache@v4
+      uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
       with:
         path: ${{ runner.temp }}/ccache
         key: firestore-ccache-${{ matrix.databaseId }}-${{ runner.os }}-${{ github.sha }}
@@ -63,13 +63,13 @@ jobs:
           firestore-ccache-${{ matrix.databaseId }}-${{ runner.os }}-
 
     - name: Cache Mint packages
-      uses: actions/cache@v4
+      uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
       with:
         path: ${{ env.MINT_PATH }}
         key: ${{ runner.os }}-mint-${{ hashFiles('**/Mintfile') }}
         restore-keys: ${{ runner.os }}-mint-
 
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
       with:
         python-version: '3.11'
 
diff --git a/.github/workflows/firestore.yml b/.github/workflows/firestore.yml
index 8315a52dd8b..ea3fb35fefc 100644
--- a/.github/workflows/firestore.yml
+++ b/.github/workflows/firestore.yml
@@ -98,9 +98,9 @@ jobs:
       (github.event_name == 'pull_request' && needs.changes.outputs.changed == 'true')
     runs-on: macos-14
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
       with:
         python-version: 3.11
 
@@ -126,10 +126,10 @@ jobs:
 
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
     - name: Prepare ccache
-      uses: actions/cache@v4
+      uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
       with:
         path: ${{ runner.temp }}/ccache
         key: firestore-ccache-${{ runner.os }}-${{ github.sha }}
@@ -137,18 +137,18 @@ jobs:
           firestore-ccache-${{ runner.os }}-
 
     - name: Cache Mint packages
-      uses: actions/cache@v4
+      uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
       with:
         path: ${{ env.MINT_PATH }}
         key: ${{ runner.os }}-mint-${{ hashFiles('**/Mintfile') }}
         restore-keys: ${{ runner.os }}-mint-
 
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
       with:
         python-version: '3.11'
 
     - name: Setup cmake
-      uses: jwlawson/actions-setup-cmake@v2
+      uses: jwlawson/actions-setup-cmake@802fa1a2c4e212495c05bf94dba2704a92a472be
       with:
         cmake-version: '3.31.1'
 
@@ -182,10 +182,10 @@ jobs:
 
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
     - name: Prepare ccache
-      uses: actions/cache@v4
+      uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
       with:
         path: ${{ runner.temp }}/ccache
         key: firestore-ccache-${{ matrix.databaseId }}-${{ runner.os }}-${{ github.sha }}
@@ -193,13 +193,13 @@ jobs:
           firestore-ccache-${{ matrix.databaseId }}-${{ runner.os }}-
 
     - name: Cache Mint packages
-      uses: actions/cache@v4
+      uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
       with:
         path: ${{ env.MINT_PATH }}
         key: ${{ runner.os }}-mint-${{ hashFiles('**/Mintfile') }}
         restore-keys: ${{ runner.os }}-mint-
 
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
       with:
         python-version: '3.11'
 
@@ -214,7 +214,7 @@ jobs:
 
     # create composite indexes with Terraform
     - name: Set up Google Cloud SDK
-      uses: google-github-actions/setup-gcloud@v1
+      uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1
     - name: Setup Terraform
       uses: hashicorp/setup-terraform@633666f66e0061ca3b725c73b2ec20cd13a8fdd1 # v2
     - name: Terraform Init
@@ -242,7 +242,7 @@ jobs:
       continue-on-error: true
 
     - name: Setup cmake
-      uses: jwlawson/actions-setup-cmake@v2
+      uses: jwlawson/actions-setup-cmake@802fa1a2c4e212495c05bf94dba2704a92a472be
       with:
         cmake-version: '3.31.1'
 
@@ -274,22 +274,22 @@ jobs:
       USE_LATEST_CMAKE: false
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
     - name: Prepare ccache
-      uses: actions/cache@v4
+      uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
       with:
         path: ${{ runner.temp }}/ccache
         key: ${{ matrix.sanitizer }}-firestore-ccache-${{ runner.os }}-${{ github.sha }}
         restore-keys: |
           ${{ matrix.sanitizer }}-firestore-ccache-${{ runner.os }}-
 
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
       with:
         python-version: '3.11'
 
     - name: Setup cmake
-      uses: jwlawson/actions-setup-cmake@v2
+      uses: jwlawson/actions-setup-cmake@802fa1a2c4e212495c05bf94dba2704a92a472be
       with:
         cmake-version: '3.31.1'
 
@@ -326,22 +326,22 @@ jobs:
       USE_LATEST_CMAKE: false
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
     - name: Prepare ccache
-      uses: actions/cache@v4
+      uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
       with:
         path: ${{ runner.temp }}/ccache
         key: ${{ matrix.sanitizer }}-firestore-ccache-${{ runner.os }}-${{ github.sha }}
         restore-keys: |
           ${{ matrix.sanitizer }}-firestore-ccache-${{ runner.os }}-
 
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
       with:
         python-version: '3.11'
 
     - name: Setup cmake
-      uses: jwlawson/actions-setup-cmake@v2
+      uses: jwlawson/actions-setup-cmake@802fa1a2c4e212495c05bf94dba2704a92a472be
       with:
         cmake-version: '3.31.1'
 
@@ -368,7 +368,7 @@ jobs:
         target: [iOS, macOS, tvOS]
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
 
@@ -423,7 +423,7 @@ jobs:
     runs-on: ${{ matrix.os }}
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Setup Bundler
@@ -448,7 +448,7 @@ jobs:
     outputs:
       cache_key: ${{ steps.generate_cache_key.outputs.cache_key }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - name: Xcode
         run: sudo xcode-select -s /Applications/Xcode_16.2.app/Contents/Developer
       - name: Generate Swift Package.resolved
@@ -460,7 +460,7 @@ jobs:
         run: |
           cache_key="${{ runner.os }}-spm-${{ hashFiles('**/Package.resolved') }}"
           echo "cache_key=${cache_key}" >> "$GITHUB_OUTPUT"
-      - uses: actions/cache/save@v4
+      - uses: actions/cache/save@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
         id: cache
         with:
           path: .build
@@ -497,7 +497,7 @@ jobs:
     env:
       FIREBASE_SOURCE_FIRESTORE: 1
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - name: Xcode
       run: sudo xcode-select -s /Applications/${{ matrix.xcode }}.app/Contents/Developer
     - name: Initialize xcodebuild
@@ -520,7 +520,7 @@ jobs:
       (github.event_name == 'pull_request' && needs.changes.outputs.changed == 'true')
     runs-on: macos-14
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - name: Assert that Firestore and FirestoreInternal have identically named headers.
       run: |
         fst_dir=Firestore/Source/Public/FirebaseFirestore/
@@ -554,7 +554,7 @@ jobs:
   #   env:
   #     FIREBASE_SOURCE_FIRESTORE: 1
   #   steps:
-  #   - uses: actions/checkout@v4
+  #   - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
   #   - name: Initialize xcodebuild
   #     run: scripts/setup_spm_tests.sh
   #   - name: Build Test - Binary
@@ -568,7 +568,7 @@ jobs:
       matrix:
         target: [tvOS, macOS, catalyst]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - name: Xcode
       run: sudo xcode-select -s /Applications/Xcode_16.4.app/Contents/Developer
     - name: Initialize xcodebuild
diff --git a/.github/workflows/generate_issues.yml b/.github/workflows/generate_issues.yml
index b4e598c355c..6a2ee3fb03c 100644
--- a/.github/workflows/generate_issues.yml
+++ b/.github/workflows/generate_issues.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Generate a nightly testing report issue
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - name: Create a nightly report
       uses: ./.github/actions/testing_report_generation/
       with:
@@ -34,7 +34,7 @@ jobs:
     runs-on: ubuntu-latest
     name: Test nightly report generations
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - name: Create a nightly report
       uses: ./.github/actions/testing_report_generation/
       with:
diff --git a/.github/workflows/health-metrics-presubmit.yml b/.github/workflows/health-metrics-presubmit.yml
index b6d01a1abda..2481c1e1a26 100644
--- a/.github/workflows/health-metrics-presubmit.yml
+++ b/.github/workflows/health-metrics-presubmit.yml
@@ -45,7 +45,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           fetch-depth: 0
       - name: check files
@@ -66,13 +66,13 @@ jobs:
       matrix:
         target: [iOS]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Setup Bundler
       run: scripts/setup_bundler.sh
     - name: Build and test
       run: ./scripts/health_metrics/pod_test_code_coverage_report.sh --sdk=FirebaseABTesting --platform=${{ matrix.target }}
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       with:
         name: codecoverage
         path: /Users/runner/*.xcresult
@@ -86,13 +86,13 @@ jobs:
       matrix:
         target: [iOS]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Setup Bundler
       run: scripts/setup_bundler.sh
     - name: Build and test
       run: ./scripts/health_metrics/pod_test_code_coverage_report.sh --sdk=FirebaseAuth --platform=${{ matrix.target }}
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       with:
         name: codecoverage
         path: /Users/runner/*.xcresult
@@ -106,7 +106,7 @@ jobs:
       matrix:
         target: [iOS]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Setup Bundler
       run: scripts/setup_bundler.sh
@@ -114,7 +114,7 @@ jobs:
       run: ./scripts/health_metrics/pod_test_code_coverage_report.sh --sdk=FirebaseDatabase --platform=${{ matrix.target }}
       # TODO: Make sure that https://github.com/actions/upload-artifact/issues/478 is resolved
       # before going to actions/upload-artifact@v4.
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       with:
         name: codecoverage
         path: /Users/runner/*.xcresult
@@ -129,7 +129,7 @@ jobs:
       matrix:
         target: [iOS]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Setup Bundler
       run: scripts/setup_bundler.sh
@@ -137,7 +137,7 @@ jobs:
       run: |
         export EXPERIMENTAL_MODE=true
         ./scripts/health_metrics/pod_test_code_coverage_report.sh --sdk=FirebaseFirestore --platform=${{ matrix.target }}
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       with:
         name: codecoverage
         path: /Users/runner/*.xcresult
@@ -151,13 +151,13 @@ jobs:
       matrix:
         target: [iOS]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Setup Bundler
       run: scripts/setup_bundler.sh
     - name: Build and test
       run: ./scripts/health_metrics/pod_test_code_coverage_report.sh --sdk=FirebaseFunctions --platform=${{ matrix.target }}
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       with:
         name: codecoverage
         path: /Users/runner/*.xcresult
@@ -171,13 +171,13 @@ jobs:
       matrix:
         target: [iOS]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Setup Bundler
       run: scripts/setup_bundler.sh
     - name: Build and test
       run: ./scripts/health_metrics/pod_test_code_coverage_report.sh --sdk=FirebaseInAppMessaging --platform=${{ matrix.target }}
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       with:
         name: codecoverage
         path: /Users/runner/*.xcresult
@@ -191,13 +191,13 @@ jobs:
       matrix:
         target: [iOS]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Setup Bundler
       run: scripts/setup_bundler.sh
     - name: Build and test
       run: ./scripts/health_metrics/pod_test_code_coverage_report.sh --sdk=FirebaseMessaging --platform=${{ matrix.target }}
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       with:
         name: codecoverage
         path: /Users/runner/*.xcresult
@@ -212,7 +212,7 @@ jobs:
       matrix:
         target: [iOS]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Setup Bundler
       run: scripts/setup_bundler.sh
@@ -220,7 +220,7 @@ jobs:
       run: gem install xcpretty
     - name: Build and test
       run: ./scripts/health_metrics/pod_test_code_coverage_report.sh --sdk=FirebasePerformance --platform=${{ matrix.target }}
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       with:
         name: codecoverage
         path: /Users/runner/*.xcresult
@@ -234,13 +234,13 @@ jobs:
       matrix:
         target: [iOS]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Setup Bundler
       run: scripts/setup_bundler.sh
     - name: Build and test
       run: ./scripts/health_metrics/pod_test_code_coverage_report.sh --sdk=FirebaseRemoteConfig --platform=${{ matrix.target }}
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       with:
         name: codecoverage
         path: /Users/runner/*.xcresult
@@ -254,13 +254,13 @@ jobs:
       matrix:
         target: [iOS]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Setup Bundler
       run: scripts/setup_bundler.sh
     - name: Build and test
       run: ./scripts/health_metrics/pod_test_code_coverage_report.sh --sdk=FirebaseStorage --platform=${{ matrix.target }}
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       with:
         name: codecoverage
         path: /Users/runner/*.xcresult
@@ -271,7 +271,7 @@ jobs:
     runs-on: macos-14
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           fetch-depth: 0
       - name: Access to Metrics Service
@@ -287,7 +287,7 @@ jobs:
           scripts/decrypt_gha_secret.sh scripts/gha-encrypted/metrics_service_access.json.gpg \
           metrics-access.json "${{ env.METRICS_SERVICE_SECRET }}"
           gcloud auth activate-service-account --key-file metrics-access.json
-      - uses: actions/download-artifact@v4.1.7
+      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         id: download
         with:
           path: /Users/runner/test
diff --git a/.github/workflows/inappmessaging.yml b/.github/workflows/inappmessaging.yml
index 7549151e064..90043377d47 100644
--- a/.github/workflows/inappmessaging.yml
+++ b/.github/workflows/inappmessaging.yml
@@ -50,7 +50,7 @@ jobs:
         platform: [iOS]
         xcode: [Xcode_16.4]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Setup Bundler
       run: scripts/setup_bundler.sh
diff --git a/.github/workflows/messaging.yml b/.github/workflows/messaging.yml
index 7a7d1ff1e4f..693125cb699 100644
--- a/.github/workflows/messaging.yml
+++ b/.github/workflows/messaging.yml
@@ -60,7 +60,7 @@ jobs:
       plist_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
     runs-on: macos-15
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - name: Configure test keychain
       run: scripts/configure_test_keychain.sh
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
@@ -113,7 +113,7 @@ jobs:
           - target: MessagingSampleStandaloneWatchApp
             platform: watchOS
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Setup Bundler
       run: scripts/setup_bundler.sh
@@ -136,7 +136,7 @@ jobs:
       run: ([ -z $plist_secret ] || scripts/build.sh ${{ matrix.target }} ${{ matrix.platform }})
     - name: Upload xcodebuild logs
       if: failure()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       with:
         name: xcodebuild-logs-${{ matrix.target }}
         path: xcodebuild-*.log
diff --git a/.github/workflows/mlmodeldownloader.yml b/.github/workflows/mlmodeldownloader.yml
index 619c9861b7d..9d097b954e9 100644
--- a/.github/workflows/mlmodeldownloader.yml
+++ b/.github/workflows/mlmodeldownloader.yml
@@ -67,7 +67,7 @@ jobs:
       plist_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
     runs-on: macos-15
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Xcode
       run: sudo xcode-select -s /Applications/Xcode_16.4.app/Contents/Developer
diff --git a/.github/workflows/nightly_ftl.yml b/.github/workflows/nightly_ftl.yml
index 562eaac3090..a4152f6db5f 100644
--- a/.github/workflows/nightly_ftl.yml
+++ b/.github/workflows/nightly_ftl.yml
@@ -66,14 +66,19 @@ jobs:
           #   plist_src_path: scripts/gha-encrypted/qs-functions.plist.gpg
           #   plist_dst_path: quickstart-ios/functions/GoogleService-Info.plist
           #   build_command: scripts/test_quickstart_ftl.sh Functions
+          # - product: RemoteConfig
+          #   setup_command: scripts/setup_quickstart.sh remoteConfig
+          #   plist_src_path: scripts/gha-encrypted/qs-functions.plist.gpg
+          #   plist_dst_path: quickstart-ios/functions/GoogleService-Info.plist
+          #   build_command: scripts/test_quickstart_ftl.sh RemoteConfig
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Setup Bundler
       run: scripts/setup_bundler.sh
     - name: Install xcpretty
       run: gem install xcpretty
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
       with:
         python-version: '3.11'
     - name: Xcode
@@ -89,7 +94,7 @@ jobs:
     - name: Build swift quickstart
       run: ([ -z $plist_secret ] || scripts/third_party/travis/retry.sh ${{ matrix.build_command }})
     - id: ftl_test
-      uses: FirebaseExtended/github-actions/firebase-test-lab@v1.4
+      uses: FirebaseExtended/github-actions/firebase-test-lab@57091ac526b308ae005c6d6d59aab83d5ab2aa71 # v1.5.0
       with:
         credentials_json: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_CREDENTIALS }}
         testapp_dir: quickstart-ios/build-for-testing
diff --git a/.github/workflows/notice_generation.yml b/.github/workflows/notice_generation.yml
index 6d769c509d1..c84ea5bbebf 100644
--- a/.github/workflows/notice_generation.yml
+++ b/.github/workflows/notice_generation.yml
@@ -22,7 +22,7 @@ jobs:
       # The path of NOTICES based on the root dir of repo."
       NOTICES_PATH: "CoreOnly/NOTICES"
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - name: Get all pod names
       run: |
         cd "${GITHUB_WORKSPACE}/ReleaseTooling/"
diff --git a/.github/workflows/performance-integration-tests.yml b/.github/workflows/performance-integration-tests.yml
index 369b4f22f81..2a49782af05 100644
--- a/.github/workflows/performance-integration-tests.yml
+++ b/.github/workflows/performance-integration-tests.yml
@@ -28,7 +28,7 @@ jobs:
       plist_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
     runs-on: macos-15
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Xcode
       run: sudo xcode-select -s /Applications/Xcode_16.4.app/Contents/Developer
diff --git a/.github/workflows/performance.yml b/.github/workflows/performance.yml
index 395e4a1db1d..bb7bbc11b11 100644
--- a/.github/workflows/performance.yml
+++ b/.github/workflows/performance.yml
@@ -56,7 +56,7 @@ jobs:
         target: [iOS, tvOS]
         test: [unit, proddev]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Xcode
       run: sudo xcode-select -s /Applications/Xcode_16.4.app/Contents/Developer
diff --git a/.github/workflows/prerelease.yml b/.github/workflows/prerelease.yml
index 7a9537ecac6..a0d23addf87 100644
--- a/.github/workflows/prerelease.yml
+++ b/.github/workflows/prerelease.yml
@@ -22,7 +22,7 @@ concurrency:
     cancel-in-progress: true
 
 jobs:
-  # TODO: The functions quickstart uses Material which isn't supported by Xcode 15
+  # TODO: The functions quickstart uses Material which isn't supported by Xcode 15+
   #functions_quickstart:
     # Don't run on private repo unless it is a PR.
     # if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'workflow_dispatch'
@@ -33,7 +33,7 @@ jobs:
     # # TODO: The functions quickstart uses Material which isn't supported by Xcode 15
     # runs-on: macos-12
     # steps:
-    # - uses: actions/checkout@v4
+    # - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     # - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     # - name: Xcode
     #   run: sudo xcode-select -s /Applications/Xcode_16.4.app/Contents/Developer
@@ -53,7 +53,7 @@ jobs:
     # - name: Remove data before upload
     #   if: ${{ failure() }}
     #   run: scripts/remove_data.sh functions
-    # - uses: actions/upload-artifact@v4
+    # - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
     #   if: ${{ failure() }}
     #   with:
     #     name: quickstart_artifacts_functions
@@ -94,7 +94,7 @@ jobs:
       botaccess: ${{ secrets.PRERELEASE_TESTING_PAT }}
     runs-on: macos-15
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Prereqs
       run: gem install xcpretty
@@ -119,7 +119,7 @@ jobs:
     - name: Remove data before upload.
       if: ${{ failure() }}
       run: scripts/remove_data.sh ${{ matrix.product }}
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       if: ${{ failure() }}
       with:
         name: quickstart_artifacts_${{ matrix.product }}
diff --git a/.github/workflows/prerelease_cocoapods.yml b/.github/workflows/prerelease_cocoapods.yml
index 684716b9c8b..4121b3283eb 100644
--- a/.github/workflows/prerelease_cocoapods.yml
+++ b/.github/workflows/prerelease_cocoapods.yml
@@ -34,7 +34,7 @@ jobs:
       matrix: ${{ steps.generate_matrix.outputs.matrix }}
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       with:
         fetch-depth: 0 # Required for pulling down repo tags.
     - name: Xcode
@@ -78,7 +78,7 @@ jobs:
       if: ${{ always() }}
       run: |
         rm -rf prerelease-testing-token.txt
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       with:
         name: firebase-ios-sdk
         path: |
@@ -96,10 +96,10 @@ jobs:
       local_sdk_repo_dir: /tmp/test/firebase-ios-sdk
       targeted_pod: FirebaseCore
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - name: Xcode
       run: sudo xcode-select -s /Applications/Xcode_16.4.app/Contents/Developer
-    - uses: actions/download-artifact@v4.1.7
+    - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
       with:
         name: firebase-ios-sdk
         path: ${{ env.local_sdk_repo_dir }}
@@ -138,10 +138,10 @@ jobs:
       local_sdk_repo_dir: /tmp/test/firebase-ios-sdk
       targeted_pod: ${{ matrix.podspec }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - name: Xcode
       run: sudo xcode-select -s /Applications/Xcode_16.4.app/Contents/Developer
-    - uses: actions/download-artifact@v4.1.7
+    - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
       with:
         name: firebase-ios-sdk
         path: ${{ env.local_sdk_repo_dir }}
@@ -179,7 +179,7 @@ jobs:
       local_repo: specstesting
       podspec_repo_branch: main
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       with:
         fetch-depth: 0 # Required for pulling down repo tags.
     - name: Xcode
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3a191c3d473..d1f412f5530 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -32,7 +32,7 @@ jobs:
   #     botaccess: ${{ secrets.RELEASE_TESTING_PAT }}
   #   runs-on: macos-12
   #   steps:
-  #   - uses: actions/checkout@v4
+  #   - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
   #   - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
   #   - name: Setup testing repo and quickstart
   #     run: BOT_TOKEN="${botaccess}" scripts/setup_quickstart.sh functions nightly_release_testing
@@ -50,7 +50,7 @@ jobs:
   #   - name: Remove data before upload
   #     if: ${{ failure() }}
   #     run: scripts/remove_data.sh functions
-  #   - uses: actions/upload-artifact@v4
+  #   - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
   #     if: ${{ failure() }}
   #     with:
   #       name: quickstart_artifacts_functions
@@ -90,7 +90,7 @@ jobs:
       botaccess: ${{ secrets.RELEASE_TESTING_PAT }}
     runs-on: macos-15
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       with:
         fetch-depth: 0 # Required for pulling down repo tags.
     - name: Set Xcode version
@@ -114,7 +114,7 @@ jobs:
     - name: Remove data before upload
       if: failure()
       run: scripts/remove_data.sh ${{ matrix.product }}
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       if: failure()
       with:
         name: quickstart_artifacts_${{ matrix.product }}
diff --git a/.github/workflows/release_cocoapods.yml b/.github/workflows/release_cocoapods.yml
index c75b089802c..1ad6c6afc00 100644
--- a/.github/workflows/release_cocoapods.yml
+++ b/.github/workflows/release_cocoapods.yml
@@ -34,7 +34,7 @@ jobs:
       matrix: ${{ steps.generate_matrix.outputs.matrix }}
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       with:
         fetch-depth: 0 # Required for pulling down repo tags.
     - name: Generate matrix
@@ -70,7 +70,7 @@ jobs:
             echo "--------------------------------------------------------------------------------"
             exit 1
          }
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       with:
         name: firebase-ios-sdk
         path: |
@@ -88,10 +88,10 @@ jobs:
       local_sdk_repo_dir: /tmp/test/firebase-ios-sdk
       targeted_pod: FirebaseCore
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - name: Set Xcode version
       run: sudo xcode-select -s /Applications/Xcode_16.4.app
-    - uses: actions/download-artifact@v4.1.7
+    - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
       with:
         name: firebase-ios-sdk
         path: ${{ env.local_sdk_repo_dir }}
@@ -123,10 +123,10 @@ jobs:
       local_sdk_repo_dir: /tmp/test/firebase-ios-sdk
       targeted_pod: ${{ matrix.podspec }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - name: Set Xcode version
       run: sudo xcode-select -s /Applications/Xcode_16.4.app
-    - uses: actions/download-artifact@v4.1.7
+    - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
       with:
         name: firebase-ios-sdk
         path: ${{ env.local_sdk_repo_dir }}
diff --git a/.github/workflows/remoteconfig.yml b/.github/workflows/remoteconfig.yml
index 6a34edf7cf4..7e91a43b49a 100644
--- a/.github/workflows/remoteconfig.yml
+++ b/.github/workflows/remoteconfig.yml
@@ -55,7 +55,7 @@ jobs:
       matrix:
         target: [iOS]
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Setup Bundler
       run: scripts/setup_bundler.sh
@@ -97,39 +97,12 @@ jobs:
     secrets:
       plist_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
 
-  # TODO(@sunmou99): currently have issue with this job, will re-enable it once the issue resolved.
-  # quickstart-ftl-cron-only:
-  #   # Don't run on private repo.
-  #   if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'
-  #   env:
-  #     plist_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
-  #   runs-on: macos-14
-  #   steps:
-  #   - uses: actions/checkout@v4
-  #   - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
-  #   - uses: actions/setup-python@v5
-  #     with:
-  #      python-version: '3.11'
-  #   - name: Setup quickstart
-  #     run: scripts/setup_quickstart.sh config
-  #   - name: Install Secret GoogleService-Info.plist
-  #     run: scripts/decrypt_gha_secret.sh scripts/gha-encrypted/qs-config.plist.gpg \
-  #         quickstart-ios/config/GoogleService-Info.plist "$plist_secret"
-  #   - name: Build Swift Quickstart
-  #     run: ([ -z $plist_secret ] || scripts/third_party/travis/retry.sh scripts/test_quickstart_ftl.sh Config)
-  #   - id: ftl_test
-  #     uses: FirebaseExtended/github-actions/firebase-test-lab@v1.4
-  #     with:
-  #       credentials_json: ${{ secrets.FIREBASE_SERVICE_ACCOUNT_CREDENTIALS }}
-  #       testapp_dir: quickstart-ios/build-for-testing
-  #       test_type: "xctest"
-
   sample-build-test:
     # Don't run on private repo unless it is a PR.
     if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'
     runs-on: macos-15
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Setup Bundler
       run: scripts/setup_bundler.sh
diff --git a/.github/workflows/sessions-integration-tests.yml b/.github/workflows/sessions-integration-tests.yml
index 7bb14d77efc..18139f66fd4 100644
--- a/.github/workflows/sessions-integration-tests.yml
+++ b/.github/workflows/sessions-integration-tests.yml
@@ -29,7 +29,7 @@ jobs:
       plist_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
     runs-on: macos-15
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - name: Xcode
       run: sudo xcode-select -s /Applications/Xcode_16.4.app/Contents/Developer
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
diff --git a/.github/workflows/spectesting.yml b/.github/workflows/spectesting.yml
index ac823242c36..f560af66198 100644
--- a/.github/workflows/spectesting.yml
+++ b/.github/workflows/spectesting.yml
@@ -20,7 +20,7 @@ jobs:
       podspecs: ${{ steps.check_files.outputs.podspecs }}
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       with:
         fetch-depth: 0
     - name: check files
@@ -55,7 +55,7 @@ jobs:
       PODSPEC: ${{ matrix.podspec }}
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       with:
         fetch-depth: 0
     - name: Init podspecs and source
@@ -65,7 +65,7 @@ jobs:
         swift run podspecs-tester --git-root "${GITHUB_WORKSPACE}" --podspec ${PODSPEC} --skip-tests --temp-log-dir "${GITHUB_WORKSPACE}/specTestingLogs"
     - name: Upload Failed Testing Logs
       if: failure()
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       with:
         name: specTestingLogs
         path: specTestingLogs/*.txt
diff --git a/.github/workflows/spm.yml b/.github/workflows/spm.yml
index eb0dba8c438..a4e68693db2 100644
--- a/.github/workflows/spm.yml
+++ b/.github/workflows/spm.yml
@@ -33,7 +33,7 @@ jobs:
     outputs:
       cache_key: ${{ steps.generate_cache_key.outputs.cache_key }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - name: Xcode
         run: sudo xcode-select -s /Applications/Xcode_16.2.app/Contents/Developer
       - name: Generate Swift Package.resolved
@@ -45,7 +45,7 @@ jobs:
         run: |
           cache_key="${{ runner.os }}-spm-${{ hashFiles('**/Package.resolved') }}"
           echo "cache_key=${cache_key}" >> "$GITHUB_OUTPUT"
-      - uses: actions/cache/save@v4
+      - uses: actions/cache/save@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
         id: cache
         with:
           path: .build
@@ -66,8 +66,8 @@ jobs:
             test: spm
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/cache/restore@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+    - uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
       with:
         path: .build
         key: ${{needs.spm-package-resolved.outputs.cache_key}}
@@ -85,7 +85,7 @@ jobs:
         max_attempts: 3
         retry_wait_seconds: 120
         command: scripts/build.sh Firebase-Package iOS ${{ matrix.test }}
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       if: ${{ failure() }}
       with:
         name: spm-build-run-${{ matrix.os }}-${{ matrix.xcode }}-logs
@@ -106,8 +106,8 @@ jobs:
             xcode: Xcode_16.4
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/cache/restore@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+    - uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
       with:
         path: .build
         key: ${{needs.spm-package-resolved.outputs.cache_key}}
@@ -119,7 +119,7 @@ jobs:
       run: scripts/setup_spm_tests.sh
     - name: iOS Device and Test Build
       run: scripts/third_party/travis/retry.sh ./scripts/build.sh Firebase-Package iOS-device spmbuildonly
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       if: ${{ failure() }}
       with:
         name: spm-ios-device-${{ matrix.os }}-${{ matrix.xcode }}-logs
@@ -143,8 +143,8 @@ jobs:
             xcode: Xcode_16.2
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/cache/restore@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+    - uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb # v5.0.1
       with:
         path: .build
         key: ${{needs.spm-package-resolved.outputs.cache_key}}
@@ -160,7 +160,7 @@ jobs:
       run: scripts/third_party/travis/retry.sh ./scripts/build.sh version-test ${{ matrix.target }} spm
     - name: Analytics Build Tests
       run: scripts/third_party/travis/retry.sh ./scripts/build.sh analytics-import-test ${{ matrix.target }} spm
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       if: ${{ failure() }}
       with:
         name: spm-platforms-${{ matrix.target }}-${{ matrix.os }}-${{ matrix.xcode }}-logs
diff --git a/.github/workflows/storage.yml b/.github/workflows/storage.yml
index 65a41b6e8fd..27c2da72753 100644
--- a/.github/workflows/storage.yml
+++ b/.github/workflows/storage.yml
@@ -50,7 +50,7 @@ jobs:
       plist_secret: ${{ secrets.GHASecretsGPGPassphrase1 }}
     runs-on: ${{ matrix.os }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Setup Bundler
       run: scripts/setup_bundler.sh
diff --git a/.github/workflows/symbolcollision.yml b/.github/workflows/symbolcollision.yml
index 731fb3dc7d5..169cbde9037 100644
--- a/.github/workflows/symbolcollision.yml
+++ b/.github/workflows/symbolcollision.yml
@@ -24,7 +24,7 @@ jobs:
     runs-on: macos-15
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Setup Bundler
       run: scripts/setup_bundler.sh
diff --git a/.github/workflows/update-cpp-sdk-on-release.yml b/.github/workflows/update-cpp-sdk-on-release.yml
index b806de8da81..8fe7c931c90 100644
--- a/.github/workflows/update-cpp-sdk-on-release.yml
+++ b/.github/workflows/update-cpp-sdk-on-release.yml
@@ -22,12 +22,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Setup python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@83679a892e2d95755f2dac6acb0bfd1e9ac5d548 # v6.1.0
         with:
           python-version: 3.11
 
       - name: Check out firebase-cpp-sdk
-        uses: actions/checkout@v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           repository: firebase/firebase-cpp-sdk
           ref: main
diff --git a/.github/workflows/watchos-sample.yml b/.github/workflows/watchos-sample.yml
index 4a1c4227261..4d8457eb4ed 100644
--- a/.github/workflows/watchos-sample.yml
+++ b/.github/workflows/watchos-sample.yml
@@ -31,7 +31,7 @@ jobs:
     if: (github.repository == 'Firebase/firebase-ios-sdk' && github.event_name == 'schedule') || github.event_name == 'pull_request'
     runs-on: macos-14
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
     - name: Setup Bundler
       run: scripts/setup_bundler.sh
diff --git a/.github/workflows/zip.yml b/.github/workflows/zip.yml
index d791fb6a3db..e9cc985c609 100644
--- a/.github/workflows/zip.yml
+++ b/.github/workflows/zip.yml
@@ -80,7 +80,7 @@ jobs:
       needs.should_package.outputs.should_package == 'true'
     runs-on: macos-14
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - name: Xcode 16.2
       run: sudo xcode-select -s /Applications/Xcode_16.2.app/Contents/Developer
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
@@ -93,7 +93,7 @@ jobs:
            "${{ github.event.inputs.custom_spec_repos || 'https://github.com/firebase/SpecsStaging.git' }}" \
            build-release \
            static
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       with:
         name: Firebase-release-zip-zip
         # Zip the entire output directory since the builder adds subdirectories we don't know the
@@ -109,7 +109,7 @@ jobs:
       needs.should_package.outputs.should_package == 'true'
     runs-on: macos-14
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - name: Xcode 16.2
       run: sudo xcode-select -s /Applications/Xcode_16.2.app/Contents/Developer
     - name: Build
@@ -125,7 +125,7 @@ jobs:
         linking_type: [static, dynamic]
     runs-on: macos-14
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - name: Xcode 16.2
       run: sudo xcode-select -s /Applications/Xcode_16.2.app/Contents/Developer
     - uses: ruby/setup-ruby@354a1ad156761f5ee2b7b13fa8e09943a5e8d252 # v1
@@ -138,7 +138,7 @@ jobs:
            zip_output_dir "${{ github.event.inputs.custom_spec_repos || 'https://github.com/firebase/SpecsStaging.git,https://github.com/firebase/SpecsDev.git' }}" \
            build-head \
            ${{ matrix.linking_type }}
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       if: always()
       with:
         name: ${{ matrix.linking_type == 'static' && 'Firebase-actions-dir' || 'Firebase-actions-dir-dynamic' }}
@@ -178,9 +178,9 @@ jobs:
     steps:
       - name: Xcode 16.2
         run: sudo xcode-select -s /Applications/Xcode_16.2.app/Contents/Developer
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
       - name: Get framework dir
-        uses: actions/download-artifact@v4.1.7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           name: Firebase-actions-dir
           run-id: ${{ needs.packaging_done.outputs.run_id }}