diff --git a/.github/actions/composer-dependency-setup/action.yml b/.github/actions/composer-dependency-setup/action.yml
index cbdc801..78b1073 100644
--- a/.github/actions/composer-dependency-setup/action.yml
+++ b/.github/actions/composer-dependency-setup/action.yml
@@ -5,7 +5,7 @@ runs:
     steps:
         - name: Cache dependencies
           id: cache-composer
-          uses: actions/cache@v4
+          uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb #5.0.1
           with:
               path: vendor
               key: ${{ runner.os }}-composer-${{ hashFiles('composer.lock', 'app-modules/**/composer.lock') }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index a81909b..0b0126d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,32 +16,30 @@ jobs:
         steps:
             - name: Checkout code | Internal
               if: ${{ github.event_name == 'merge_group' || github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]' }}
-              uses: actions/checkout@v4
+              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #6.0.1
               with:
                   token: ${{ secrets.pat-token }}
 
             - name: Checkout code | External
               if: ${{ github.event_name != 'merge_group' && github.event.pull_request.head.repo.full_name != github.repository || github.actor == 'dependabot[bot]' }}
-              uses: actions/checkout@v4
+              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #6.0.1
 
             - name: Set up Ruby
-              uses: ruby/setup-ruby@v1
+              uses: ruby/setup-ruby@d697be2f83c6234b20877c3b5eac7a7f342f0d0c #1.269.0
 
             - name: Run Ruby Script
               run: ruby ./copyright.rb
 
             - name: Commit changes
               if: ${{ github.event_name != 'merge_group' && github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]' }}
-              # SHA of release v5.0.1
-              uses: stefanzweifel/git-auto-commit-action@28e16e81777b558cc906c8750092100bbb34c5e3
+              uses: stefanzweifel/git-auto-commit-action@28e16e81777b558cc906c8750092100bbb34c5e3 #7.0.0
               with:
                   commit_message: >
                       chore: fix enforcement of copyright on all files
 
             - name: Check for changes
               if: ${{ github.event_name == 'merge_group' || github.event.pull_request.head.repo.full_name != github.repository || github.actor == 'dependabot[bot]' }}
-              # SHA of release v20.0.1
-              uses: tj-actions/verify-changed-files@a1c6acee9df209257a246f2cc6ae8cb6581c1edf
+              uses: tj-actions/verify-changed-files@a1c6acee9df209257a246f2cc6ae8cb6581c1edf #20.0.4
               with:
                   fail-if-changed: 'true'
 
@@ -53,32 +51,32 @@ jobs:
         needs: [enforce-copyright]
 
         steps:
-            - uses: shivammathur/setup-php@v2
+            - uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 #2.36.0
               with:
                   php-version: '8.4'
                   coverage: none
 
             - name: Checkout code | Internal
               if: ${{ github.event_name == 'merge_group' || github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]' }}
-              uses: actions/checkout@v4
+              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #6.0.1
               with:
                   token: ${{ secrets.pat-token }}
 
             - name: Checkout code | External
               if: ${{ github.event_name != 'merge_group' && github.event.pull_request.head.repo.full_name != github.repository || github.actor == 'dependabot[bot]' }}
-              uses: actions/checkout@v4
+              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #6.0.1
 
             - name: Setup Dependencies
               uses: ./.github/actions/composer-dependency-setup
 
-            - uses: actions/setup-node@v6
+            - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f #6.1.0
               with:
                   node-version-file: '.nvmrc'
                   cache: 'npm'
             - run: npm install
 
             - name: Cache PHP CS Fixer
-              uses: actions/cache@v5
+              uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb #5.0.1
               with:
                   path: .php-cs-fixer.cache
                   key: ${{ runner.OS }}-${{ github.repository }}-phpcsfixer-${{ github.run_id }}
@@ -86,7 +84,7 @@ jobs:
                       ${{ runner.OS }}-${{ github.repository }}-phpcsfixer-
 
             - name: Cache Prettier
-              uses: actions/cache@v5
+              uses: actions/cache@9255dc7a253b0ccc959486e2bca901246202afeb #5.0.1
               with:
                   path: ./node_modules/.cache/prettier/.prettier-cache
                   key: ${{ runner.OS }}-${{ github.repository }}-prettier-${{ github.run_id }}
@@ -98,16 +96,14 @@ jobs:
 
             - name: Commit changes
               if: ${{ github.event_name != 'merge_group' && github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]' }}
-              # SHA of release v5.0.1
-              uses: stefanzweifel/git-auto-commit-action@28e16e81777b558cc906c8750092100bbb34c5e3
+              uses: stefanzweifel/git-auto-commit-action@28e16e81777b558cc906c8750092100bbb34c5e3 #7.0.0
               with:
                   commit_message: >
                       chore: fix code style
 
             - name: Check for changes
               if: ${{ github.event_name == 'merge_group' || github.event.pull_request.head.repo.full_name != github.repository || github.actor == 'dependabot[bot]' }}
-              # SHA of release v20.0.1
-              uses: tj-actions/verify-changed-files@a1c6acee9df209257a246f2cc6ae8cb6581c1edf
+              uses: tj-actions/verify-changed-files@a1c6acee9df209257a246f2cc6ae8cb6581c1edf #20.0.4
               with:
                   fail-if-changed: 'true'
 
@@ -119,13 +115,13 @@ jobs:
         needs: [enforce-copyright, fix-code-style]
 
         steps:
-            - uses: shivammathur/setup-php@v2
+            - uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 #2.36.0
               with:
                   php-version: '8.4'
                   coverage: none
                   extensions: gd, gmp, redis
 
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #6.0.1
               with:
                   fetch-depth: 0
                   fetch-tags: true
@@ -134,7 +130,7 @@ jobs:
               uses: ./.github/actions/composer-dependency-setup
 
             - name: 'Restore result cache'
-              uses: actions/cache/restore@v5
+              uses: actions/cache/restore@9255dc7a253b0ccc959486e2bca901246202afeb #5.0.1
               with:
                   path: tmp
                   key: 'phpstan-result-cache-${{ github.run_id }}'
@@ -145,7 +141,7 @@ jobs:
               run: ./vendor/bin/phpstan analyse --configuration phpstan-ci.neon --no-progress
 
             - name: 'Save result cache'
-              uses: actions/cache/save@v5
+              uses: actions/cache/save@9255dc7a253b0ccc959486e2bca901246202afeb #5.0.1
               if: ${{ !cancelled() }}
               with:
                   path: tmp
@@ -159,13 +155,13 @@ jobs:
         needs: [enforce-copyright, fix-code-style]
 
         steps:
-            - uses: shivammathur/setup-php@v2
+            - uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 #2.36.0
               with:
                   php-version: '8.4'
                   coverage: none
                   extensions: gd, gmp, redis, mailparse
 
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #6.0.1
               with:
                   fetch-depth: 0
                   fetch-tags: true
@@ -173,7 +169,7 @@ jobs:
             - name: Setup Dependencies
               uses: ./.github/actions/composer-dependency-setup
 
-            - uses: actions/setup-node@v6
+            - uses: actions/setup-node@395ad3262231945c25e8478fd5baf05154b1d79f #6.1.0
               with:
                   node-version-file: '.nvmrc'
                   cache: 'npm'
diff --git a/.github/workflows/update_yearly_copyright.yml b/.github/workflows/update_yearly_copyright.yml
index b2c70d0..b4d20f0 100644
--- a/.github/workflows/update_yearly_copyright.yml
+++ b/.github/workflows/update_yearly_copyright.yml
@@ -13,19 +13,18 @@ jobs:
 
         steps:
             - name: Checkout `main` Branch
-              uses: actions/checkout@v4
+              uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 #6.0.1
               with:
                   token: ${{ secrets.PAT }}
 
             - name: Set up Ruby
-              uses: ruby/setup-ruby@v1
+              uses: ruby/setup-ruby@d697be2f83c6234b20877c3b5eac7a7f342f0d0c #1.269.0
 
             - name: Run copyright script
               run: ruby ./copyright.rb
 
             - name: Create Pull Request
-              # SHA of release v6.1.0
-              uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725
+              uses: peter-evans/create-pull-request@98357b18bf14b5342f975ff684046ec3b2a07725 #8.0.0
               with:
                   token: ${{ secrets.PAT }}
                   commit-message: >