diff --git a/.github/actions/clp-core-build-containers/action.yaml b/.github/actions/clp-core-build-containers/action.yaml
index 157da0f131..e95b368caf 100644
--- a/.github/actions/clp-core-build-containers/action.yaml
+++ b/.github/actions/clp-core-build-containers/action.yaml
@@ -21,10 +21,10 @@ inputs:
 runs:
   using: "composite"
   steps:
-    - uses: "docker/setup-buildx-action@v3"
+    - uses: "docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2"
 
     - if: "inputs.push_deps_image == 'true'"
-      uses: "docker/login-action@v3"
+      uses: "docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772"
       with:
         registry: "ghcr.io"
         username: "${{github.actor}}"
@@ -52,13 +52,13 @@ runs:
         fi
 
     - id: "deps_image_meta"
-      uses: "docker/metadata-action@v5"
+      uses: "docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804"
       with:
         images: "${{steps.get_image_props.outputs.qualified_image_name}}"
         tags: |
           type=raw,value=${{steps.get_image_props.outputs.branch}}
 
-    - uses: "docker/build-push-action@v5"
+    - uses: "docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4"
       with:
         context: "${{inputs.docker_context}}"
         file: "${{inputs.docker_file}}"
@@ -67,7 +67,7 @@ runs:
         outputs: "${{steps.get_image_props.outputs.output}}"
 
     - if: "inputs.push_deps_image == 'false'"
-      uses: "actions/upload-artifact@v4"
+      uses: "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02"
       with:
         name: "${{steps.get_image_props.outputs.qualified_image_name}}"
         path: "${{steps.get_image_props.outputs.image_path}}"
diff --git a/.github/actions/clp-execution-image-build/action.yaml b/.github/actions/clp-execution-image-build/action.yaml
index 45d87dff2b..e42c17e7fd 100644
--- a/.github/actions/clp-execution-image-build/action.yaml
+++ b/.github/actions/clp-execution-image-build/action.yaml
@@ -27,10 +27,10 @@ runs:
   using: "composite"
   steps:
     - name: "Set up Docker Buildx"
-      uses: "docker/setup-buildx-action@v3"
+      uses: "docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2"
 
     - name: "Login to Image Registry"
-      uses: "docker/login-action@v3"
+      uses: "docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772"
       with:
         registry: "${{inputs.image_registry}}"
         username: "${{inputs.image_registry_username}}"
@@ -47,14 +47,14 @@ runs:
 
     - name: "Update Metadata"
       id: "meta"
-      uses: "docker/metadata-action@v5"
+      uses: "docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804"
       with:
         images: "${{inputs.image_registry}}/${{steps.sanitization.outputs.REPOSITORY}}\
           /clp-execution-x86-${{inputs.platform_id}}-${{inputs.platform_version_id}}"
 
     - name: "Build and Push"
       if: "github.event_name != 'pull_request' && github.ref == 'refs/heads/main'"
-      uses: "docker/build-push-action@v5"
+      uses: "docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4"
       with:
         context: "./"
         file: "./tools/docker-images/\
diff --git a/.github/actions/run-on-image/action.yaml b/.github/actions/run-on-image/action.yaml
index a96ebaec3a..25df6207a1 100644
--- a/.github/actions/run-on-image/action.yaml
+++ b/.github/actions/run-on-image/action.yaml
@@ -16,7 +16,7 @@ runs:
   using: "composite"
   steps:
     - if: "inputs.use_published_image == 'false'"
-      uses: "actions/download-artifact@v4"
+      uses: "actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e"
       with:
         name: "${{inputs.image_name}}"
         path: "/tmp"
diff --git a/.github/workflows/clp-core-build-macos.yaml b/.github/workflows/clp-core-build-macos.yaml
index f9ec13da42..e1408eac65 100644
--- a/.github/workflows/clp-core-build-macos.yaml
+++ b/.github/workflows/clp-core-build-macos.yaml
@@ -41,6 +41,7 @@ concurrency:
 
 jobs:
   build-macos:
+    name: "build-macos"
     strategy:
       matrix:
         os:
@@ -52,7 +53,7 @@ jobs:
           - false
     runs-on: "${{matrix.os}}"
     steps:
-      - uses: "actions/checkout@v4"
+      - uses: "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683"
         with:
           # Fetch history so that the `clang-tidy-diff` task can compare against the main branch.
           fetch-depth: 0
diff --git a/.github/workflows/clp-core-build.yaml b/.github/workflows/clp-core-build.yaml
index 3f5d17e731..5c95ae7ef9 100644
--- a/.github/workflows/clp-core-build.yaml
+++ b/.github/workflows/clp-core-build.yaml
@@ -37,13 +37,14 @@ concurrency: "${{github.workflow}}-${{github.ref}}"
 
 jobs:
   filter-relevant-changes:
+    name: "filter-relevant-changes"
     runs-on: "ubuntu-latest"
     outputs:
       centos_stream_9_image_changed: "${{steps.filter.outputs.centos_stream_9_image}}"
       ubuntu_jammy_image_changed: "${{steps.filter.outputs.ubuntu_jammy_image}}"
       clp_changed: "${{steps.filter.outputs.clp}}"
     steps:
-      - uses: "actions/checkout@v4"
+      - uses: "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683"
         with:
           submodules: "recursive"
 
@@ -52,7 +53,7 @@ jobs:
         shell: "bash"
 
       - name: "Filter relevant changes"
-        uses: "dorny/paths-filter@v3"
+        uses: "dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36"
         id: "filter"
         with:
           # Consider changes between the current commit and `main`
@@ -91,11 +92,12 @@ jobs:
               - "tools/scripts/deps-download/**"
 
   centos-stream-9-deps-image:
+    name: "centos-stream-9-deps-image"
     if: "needs.filter-relevant-changes.outputs.centos_stream_9_image_changed == 'true'"
     needs: "filter-relevant-changes"
     runs-on: "ubuntu-latest"
     steps:
-      - uses: "actions/checkout@v4"
+      - uses: "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683"
         with:
           submodules: "recursive"
 
@@ -116,11 +118,12 @@ jobs:
           token: "${{secrets.GITHUB_TOKEN}}"
 
   ubuntu-jammy-deps-image:
+    name: "ubuntu-jammy-deps-image"
     if: "needs.filter-relevant-changes.outputs.ubuntu_jammy_image_changed == 'true'"
     needs: "filter-relevant-changes"
     runs-on: "ubuntu-latest"
     steps:
-      - uses: "actions/checkout@v4"
+      - uses: "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683"
         with:
           submodules: "recursive"
 
@@ -155,7 +158,7 @@ jobs:
     continue-on-error: true
     runs-on: "ubuntu-latest"
     steps:
-      - uses: "actions/checkout@v4"
+      - uses: "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683"
         with:
           submodules: "recursive"
 
@@ -200,7 +203,7 @@ jobs:
     continue-on-error: true
     runs-on: "ubuntu-latest"
     steps:
-      - uses: "actions/checkout@v4"
+      - uses: "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683"
         with:
           submodules: "recursive"
 
@@ -234,13 +237,14 @@ jobs:
         shell: "bash"
 
       - if: "matrix.upload_binaries == true"
-        uses: "actions/upload-artifact@v4"
+        uses: "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02"
         with:
           name: "${{env.BINARIES_ARTIFACT_NAME_PREFIX}}${{env.OS_NAME}}"
           path: "${{steps.copy_binaries.outputs.output_dir}}"
           retention-days: 1
 
   ubuntu-jammy-binaries-image:
+    name: "ubuntu-jammy-binaries-image"
     # Run if the ancestor jobs were successful/skipped and building clp was successful.
     if: "!cancelled() && !failure() && needs.ubuntu-jammy-binaries.result == 'success'"
     needs: "ubuntu-jammy-binaries"
@@ -249,7 +253,7 @@ jobs:
       OS_NAME: "ubuntu-jammy"
       TMP_OUTPUT_DIR: "/tmp"
     steps:
-      - uses: "actions/checkout@v4"
+      - uses: "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683"
         with:
           submodules: "recursive"
 
@@ -257,7 +261,7 @@ jobs:
         run: "chown $(id -u):$(id -g) -R ."
         shell: "bash"
 
-      - uses: "actions/download-artifact@v4"
+      - uses: "actions/download-artifact@95815c38cf2ff2164869cbab79da8d1f422bc89e"
         with:
           name: "${{env.BINARIES_ARTIFACT_NAME_PREFIX}}${{env.OS_NAME}}"
           path: "${{env.TMP_OUTPUT_DIR}}/${{env.BINARIES_ARTIFACT_NAME_PREFIX}}${{env.OS_NAME}}"
@@ -269,7 +273,7 @@ jobs:
           tar xf clp.tar
           rm clp.tar
 
-      - uses: "docker/login-action@v3"
+      - uses: "docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772"
         with:
           registry: "ghcr.io"
           username: "${{github.actor}}"
@@ -285,7 +289,7 @@ jobs:
         shell: "bash"
 
       - id: "core_image_meta"
-        uses: "docker/metadata-action@v5"
+        uses: "docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804"
         with:
           images: >-
             ghcr.io/${{steps.sanitize_repo_name.outputs.repository}}/clp-core-x86-${{env.OS_NAME}}
@@ -294,7 +298,7 @@ jobs:
       # Only publish the image if this workflow was triggered by a push to `main`.
       # NOTE: We run the rest of the job to test that the binaries were uploaded correctly.
       - if: "github.event_name == 'push' && github.ref == 'refs/heads/main'"
-        uses: "docker/build-push-action@v5"
+        uses: "docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4"
         with:
           context: "${{env.TMP_OUTPUT_DIR}}/${{env.BINARIES_ARTIFACT_NAME_PREFIX}}${{env.OS_NAME}}"
           file: "components/core/tools/docker-images/clp-core-${{env.OS_NAME}}/Dockerfile"
@@ -303,6 +307,7 @@ jobs:
           labels: "${{steps.core_image_meta.outputs.labels}}"
 
   ubuntu-jammy-lint:
+    name: "ubuntu-jammy-lint"
     # Run if the ancestor jobs succeeded OR they were skipped and clp was changed.
     if: >-
       success()
@@ -312,7 +317,7 @@ jobs:
       - "ubuntu-jammy-deps-image"
     runs-on: "ubuntu-latest"
     steps:
-      - uses: "actions/checkout@v4"
+      - uses: "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683"
         with:
           # Fetch history so that the `clang-tidy-diff` task can compare against the main branch.
           fetch-depth: 0
diff --git a/.github/workflows/clp-docs.yaml b/.github/workflows/clp-docs.yaml
index 8bb07a29ea..fd09a367e6 100644
--- a/.github/workflows/clp-docs.yaml
+++ b/.github/workflows/clp-docs.yaml
@@ -15,16 +15,17 @@ concurrency:
 
 jobs:
   build:
+    name: "build"
     strategy:
       matrix:
         os: ["macos-latest", "ubuntu-latest"]
     runs-on: "${{matrix.os}}"
     steps:
-      - uses: "actions/checkout@v4"
+      - uses: "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683"
         with:
           submodules: "recursive"
 
-      - uses: "actions/setup-python@v5"
+      - uses: "actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38"
         with:
           python-version: "3.10"
 
@@ -45,7 +46,7 @@ jobs:
           contains(fromJSON('["push", "workflow_dispatch"]'), github.event_name)
           && ('refs/heads/main' == github.ref || startsWith(github.ref, 'refs/tags/v'))
           && 'ubuntu-latest' == matrix.os
-        uses: "actions/upload-artifact@v4"
+        uses: "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02"
         with:
           name: "docs-html"
           path: "build/docs/html"
diff --git a/.github/workflows/clp-execution-image-build.yaml b/.github/workflows/clp-execution-image-build.yaml
index 75e872d44e..17789906e8 100644
--- a/.github/workflows/clp-execution-image-build.yaml
+++ b/.github/workflows/clp-execution-image-build.yaml
@@ -23,11 +23,12 @@ concurrency:
 
 jobs:
   filter-relevant-changes:
+    name: "filter-relevant-changes"
     runs-on: "ubuntu-latest"
     outputs:
       ubuntu_jammy_image_changed: "${{steps.filter.outputs.ubuntu_jammy_image}}"
     steps:
-      - uses: "actions/checkout@v4"
+      - uses: "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683"
         with:
           submodules: "recursive"
 
@@ -36,7 +37,7 @@ jobs:
         shell: "bash"
 
       - name: "Filter relevant changes"
-        uses: "dorny/paths-filter@v3"
+        uses: "dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36"
         id: "filter"
         with:
           base: "main"
@@ -46,12 +47,13 @@ jobs:
               - ".github/workflows/clp-execution-image-build.yaml"
               - "tools/docker-images/clp-execution-base-ubuntu-jammy/**/*"
 
-  ubuntu_jammy_execution_image:
+  ubuntu-jammy-execution-image:
+    name: "ubuntu-jammy-execution-image"
     if: "'true' == needs.filter-relevant-changes.outputs.ubuntu_jammy_image_changed"
     needs: "filter-relevant-changes"
     runs-on: "ubuntu-latest"
     steps:
-      - uses: "actions/checkout@v4"
+      - uses: "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683"
         with:
           submodules: "recursive"
 
diff --git a/.github/workflows/clp-lint.yaml b/.github/workflows/clp-lint.yaml
index b29a40e3e3..5f800d8c23 100644
--- a/.github/workflows/clp-lint.yaml
+++ b/.github/workflows/clp-lint.yaml
@@ -15,16 +15,17 @@ concurrency:
 
 jobs:
   lint-check:
+    name: "lint-check"
     strategy:
       matrix:
         os: ["macos-latest", "ubuntu-latest"]
     runs-on: "${{matrix.os}}"
     steps:
-      - uses: "actions/checkout@v4"
+      - uses: "actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683"
         with:
           submodules: "recursive"
 
-      - uses: "actions/setup-python@v5"
+      - uses: "actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38"
         with:
           python-version: "3.11"
 
diff --git a/.github/workflows/clp-pr-title-checks.yaml b/.github/workflows/clp-pr-title-checks.yaml
index 1c8ced072d..0aa1533a98 100644
--- a/.github/workflows/clp-pr-title-checks.yaml
+++ b/.github/workflows/clp-pr-title-checks.yaml
@@ -20,11 +20,12 @@ concurrency:
 
 jobs:
   conventional-commits:
+    name: "conventional-commits"
     permissions:
       # For amannn/action-semantic-pull-request
       pull-requests: "read"
     runs-on: "ubuntu-latest"
     steps:
-      - uses: "amannn/action-semantic-pull-request@v5"
+      - uses: "amannn/action-semantic-pull-request@0723387faaf9b38adef4775cd42cfd5155ed6017"
         env:
           GITHUB_TOKEN: "${{secrets.GITHUB_TOKEN}}"