diff --git a/.github/actions/setup_cached_java/action.yml b/.github/actions/setup_cached_java/action.yml
index 2ed09050d..516132fd0 100644
--- a/.github/actions/setup_cached_java/action.yml
+++ b/.github/actions/setup_cached_java/action.yml
@@ -27,7 +27,7 @@ runs:
           fi
       - name: Cache Build JDK [${{ inputs.arch }}]
         id: cache_build_jdk
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             jdks/${{ steps.infer_build_jdk.outputs.build_jdk }}
@@ -37,7 +37,7 @@ runs:
           enableCrossOsArchive: true
       - name: Cache JDK ${{ inputs.version }} [${{ inputs.arch }}]
         id: cache_jdk
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             jdks/jdk${{ inputs.version }}
diff --git a/.github/workflows/approve-trivial.yml b/.github/workflows/approve-trivial.yml
index 1968a1ddc..41ca9dc36 100644
--- a/.github/workflows/approve-trivial.yml
+++ b/.github/workflows/approve-trivial.yml
@@ -17,6 +17,6 @@ jobs:
           scope: DataDog/java-profiler
           policy: self.approve-trivial.approve-pr
       - name: Auto-approve PR
-        uses: hmarr/auto-approve-action@v4
+        uses: hmarr/auto-approve-action@8f929096a962e83ccdfa8afcf855f39f12d4dac7 # v4
         with:
           github-token: ${{ steps.octo-sts.outputs.token }}
diff --git a/.github/workflows/cache_java.yml b/.github/workflows/cache_java.yml
index a284f000a..6a704b248 100644
--- a/.github/workflows/cache_java.yml
+++ b/.github/workflows/cache_java.yml
@@ -68,7 +68,7 @@ jobs:
       sdkman_path: ${{ steps.export-path.outputs.sdkman_path }}
     steps:
       - name: Cache SDKMan! AMD64
-        uses: actions/cache@v5
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: sdkman
           key: sdkman-amd64-${{ github.run_id }}
@@ -96,7 +96,7 @@ jobs:
         run: |
           curl -s "https://get.sdkman.io" | bash
       - name: Upload SDKMAN! as Artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: sdkman-installation-amd64
           path: ${{ env.SDKMAN_DIR }}
@@ -109,7 +109,7 @@ jobs:
       sdkman_path: ${{ steps.export-path.outputs.sdkman_path }}
     steps:
       - name: Cache SDKMan! AARCH64
-        uses: actions/cache@v5
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: sdkman
           key: sdkman-aarch64-${{ github.run_id }}
@@ -136,7 +136,7 @@ jobs:
         run: |
           curl -s "https://get.sdkman.io" | bash
       - name: Upload SDKMAN! as Artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: sdkman-installation-aarch64
           path: ${{ env.SDKMAN_DIR }}
@@ -151,10 +151,10 @@ jobs:
         # FIXME: Zing disabled - Azul pulled public CDN access
         java_variant: [ "8", "8-orcl", "8-j9", "8-ibm", "11", "11-j9", "17", "17-j9", "17-graal", "21", "21-j9", "21-graal", "25", "25-graal" ]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Try restore cache JDK ${{ matrix.java_variant }}
         id: cache-jdk
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: |
             ${{ env.JDKS_DIR }}/jdk${{ matrix.java_variant }}
@@ -175,7 +175,7 @@ jobs:
           sudo apt-get install -y curl zip unzip
       - name: Download SDKMAN! from Artifact
         if: steps.check-cache.outputs.cache-hit != 'true'
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: sdkman-installation-amd64
           path: sdkman
@@ -193,7 +193,7 @@ jobs:
 
       - name: Save JDK ${{ matrix.java_variant }} cache
         if: steps.check-cache.outputs.cache-hit != 'true'
-        uses: actions/cache/save@v5
+        uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: |
             ${{ env.JDKS_DIR }}/jdk${{ matrix.java_variant }}
@@ -210,14 +210,14 @@ jobs:
       matrix:
         java_variant: [ "8-librca", "11-librca", "17-librca", "21-librca", "25-librca" ]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup OS
         run: |
           # This needs to be done early because alpine does not have bash and tar is also iffy
           apk update && apk add curl zip unzip bash tar
       - name: Cache JDK ${{ matrix.java_variant }}
         id: cache-jdk
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: |
             ${{ env.JDKS_DIR }}/jdk${{ matrix.java_variant }}
@@ -243,7 +243,7 @@ jobs:
 
       - name: Save JDK ${{ matrix.java_variant }} cache
         if: steps.check-cache.outputs.cache-hit != 'true'
-        uses: actions/cache/save@v5
+        uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: |
             ${{ env.JDKS_DIR }}/jdk${{ matrix.java_variant }}
@@ -262,10 +262,10 @@ jobs:
         # FIXME: Zing disabled - Azul pulled public CDN access
         java_variant: [ "8", "8-j9", "11", "11-j9", "17", "17-j9", "17-graal", "21", "21-j9", "21-graal", "25", "25-graal" ]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Cache JDK ${{ matrix.java_variant }}
         id: cache-jdk
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: |
             ${{ env.JDKS_DIR }}/jdk${{ matrix.java_variant }}
@@ -286,7 +286,7 @@ jobs:
           sudo apt-get install -y curl zip unzip
       - name: Download SDKMAN! from Artifact
         if: steps.check-cache.outputs.cache-hit != 'true'
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: sdkman-installation-aarch64
           path: sdkman
@@ -303,7 +303,7 @@ jobs:
 
       - name: Save JDK ${{ matrix.java_variant }} cache
         if: steps.check-cache.outputs.cache-hit != 'true'
-        uses: actions/cache/save@v5
+        uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: |
             ${{ env.JDKS_DIR }}/jdk${{ matrix.java_variant }}
@@ -319,14 +319,14 @@ jobs:
       matrix:
         java_variant: [ "8-librca", "11-librca", "17-librca", "21-librca", "25-librca" ]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup OS
         run: |
           # This needs to be done early because alpine does not have bash and tar is also iffy
           sudo apt update && sudo apt install -y curl zip unzip bash tar
       - name: Cache JDK ${{ matrix.java_variant }}
         id: cache-jdk
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: |
             ${{ env.JDKS_DIR }}/jdk${{ matrix.java_variant }}
@@ -352,7 +352,7 @@ jobs:
 
       - name: Save JDK ${{ matrix.java_variant }} cache
         if: steps.check-cache.outputs.cache-hit != 'true'
-        uses: actions/cache/save@v5
+        uses: actions/cache/save@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: |
             ${{ env.JDKS_DIR }}/jdk${{ matrix.java_variant }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e33a2942c..3c798dae4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -46,10 +46,10 @@ jobs:
     needs: check-for-pr
     if: needs.check-for-pr.outputs.skip != 'true'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: 'zulu'
           java-version: '21'
@@ -63,7 +63,7 @@ jobs:
           sudo mv /usr/bin/clang-format-11 /usr/bin/clang-format
 
       - name: Cache Gradle Wrapper Binaries
-        uses: actions/cache@v5
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: ~/.gradle/wrapper/dists
           key: gradle-wrapper-${{ runner.os }}-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties') }}
@@ -71,7 +71,7 @@ jobs:
             gradle-wrapper-${{ runner.os }}-
 
       - name: Cache Gradle User Home
-        uses: actions/cache@v5
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: ~/.gradle/caches
           key: gradle-caches-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
@@ -87,10 +87,10 @@ jobs:
     needs: check-for-pr
     if: needs.check-for-pr.outputs.skip != 'true'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: 'zulu'
           java-version: '21'
@@ -101,7 +101,7 @@ jobs:
           sudo apt-get install -y curl zip unzip binutils
 
       - name: Cache Gradle Wrapper Binaries
-        uses: actions/cache@v5
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: ~/.gradle/wrapper/dists
           key: gradle-wrapper-${{ runner.os }}-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties') }}
@@ -109,7 +109,7 @@ jobs:
             gradle-wrapper-${{ runner.os }}-
 
       - name: Cache Gradle User Home
-        uses: actions/cache@v5
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: ~/.gradle/caches
           key: gradle-caches-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
@@ -178,7 +178,7 @@ jobs:
       actions: read
       id-token: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Generate test summary
         env:
diff --git a/.github/workflows/codecheck.yml b/.github/workflows/codecheck.yml
index 19a652388..fe473bd4c 100644
--- a/.github/workflows/codecheck.yml
+++ b/.github/workflows/codecheck.yml
@@ -21,13 +21,13 @@ jobs:
     env:
       HEAD_REF: ${{ github.head_ref }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: System setup
         run: |
           sudo apt-get update
           sudo apt install -y clang clang-tools openjdk-11-jdk
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: 3.9
       - name: Install Python dependencies
@@ -38,7 +38,7 @@ jobs:
         run: |
           ./gradlew scanBuild --no-daemon
       - name: Upload logs
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         if: always()
         with:
           name: scan-build-reports
@@ -71,11 +71,11 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -84,4 +84,4 @@ jobs:
           # queries: ./path/to/local/query, your-org/your-repo/queries@main
       - run: ./gradlew -x test assembleReleaseJar
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@b1bff81932f5cdfc8695c7752dcee935dcd061c8 # v4.33.0
diff --git a/.github/workflows/gh_release.yml b/.github/workflows/gh_release.yml
index 6d83b58f1..92d00ee41 100644
--- a/.github/workflows/gh_release.yml
+++ b/.github/workflows/gh_release.yml
@@ -26,15 +26,15 @@ jobs:
     if: (startsWith(github.event.ref, 'refs/tags/v_') || inputs.release_tag != '') && !endsWith(github.event.ref, '-SNAPSHOT')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
-      - uses: webfactory/ssh-agent@v0.9.1
+      - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
         with:
           ssh-private-key: ${{ secrets.SSH_PUSH_SECRET }}
       - name: Create Release [automatic]
         id: create_release_auto
-        uses: ncipollo/release-action@v1
+        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
         if: ${{ startsWith(github.ref, 'refs/tags/') }}
         with:
           generateReleaseNotes: true
@@ -44,7 +44,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Create Release [manual]
         id: create_release_manual
-        uses: ncipollo/release-action@v1
+        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
         if: ${{ !startsWith(github.ref, 'refs/tags/') }}
         with:
           generateReleaseNotes: true
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 245c7f390..600c94a5b 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -21,7 +21,7 @@ jobs:
     if: failure()
     steps:
       - name: Download all failure artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: failures-*
           path: ./artifacts
diff --git a/.github/workflows/release-validated.yml b/.github/workflows/release-validated.yml
index a9e74c43b..b131db5fe 100644
--- a/.github/workflows/release-validated.yml
+++ b/.github/workflows/release-validated.yml
@@ -36,12 +36,12 @@ jobs:
       release_branch: ${{ steps.compute-version.outputs.release_branch }}
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 
       - name: Setup Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: 'zulu'
           java-version: '21'
@@ -153,7 +153,7 @@ jobs:
           echo "::error::Pre-release tests failed. Cannot proceed with release."
           exit 1
 
-      - uses: webfactory/ssh-agent@v0.9.1
+      - uses: webfactory/ssh-agent@a6f90b1f127823b31d4d4a8d96047790581349bd # v0.9.1
         with:
           ssh-private-key: ${{ secrets.SSH_PUSH_SECRET }}
 
@@ -168,7 +168,7 @@ jobs:
           git checkout $GITHUB_REF_NAME
 
       - name: Setup Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: 'zulu'
           java-version: '21'
diff --git a/.github/workflows/test_workflow.yml b/.github/workflows/test_workflow.yml
index c8a2a3be9..606c07bdd 100644
--- a/.github/workflows/test_workflow.yml
+++ b/.github/workflows/test_workflow.yml
@@ -52,11 +52,11 @@ jobs:
               echo "enabled=false" >> $GITHUB_OUTPUT
             fi
           fi
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         if: steps.set_enabled.outputs.enabled == 'true'
       - name: Cache Gradle Wrapper Binaries
         if: steps.set_enabled.outputs.enabled == 'true'
-        uses: actions/cache@v5
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: ~/.gradle/wrapper/dists
           key: gradle-wrapper-${{ runner.os }}-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties') }}
@@ -64,7 +64,7 @@ jobs:
             gradle-wrapper-${{ runner.os }}-
       - name: Cache Gradle User Home
         if: steps.set_enabled.outputs.enabled == 'true'
-        uses: actions/cache@v5
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: ~/.gradle/caches
           key: gradle-caches-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
@@ -137,13 +137,13 @@ jobs:
           echo "## 🔧 Unwinding Quality Report - ${{ matrix.java_version }} (amd64)" >> $GITHUB_STEP_SUMMARY
           cat ddprof-test/build/reports/unwinding-summary.md >> $GITHUB_STEP_SUMMARY
       - name: Upload build artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         if: success()
         with:
           name: (build) test-linux-glibc-amd64 (${{ matrix.java_version }}, ${{ matrix.config }})
           path: build/
       - name: Upload failures
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         if: failure()
         with:
           name: failures-glibc-${{ matrix.java_version }}-${{ matrix.config }}-amd64
@@ -153,13 +153,13 @@ jobs:
         run: |
           .github/scripts/prepare_reports.sh
       - name: Upload unwinding reports
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         if: success() && matrix.config == 'debug'
         with:
           name: (unwinding-reports) unwinding-linux-glibc-amd64 (${{ matrix.java_version }}, ${{ matrix.config }})
           path: unwinding-reports
       - name: Upload test reports
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         if: failure()
         with:
           name: (test-reports) test-linux-glibc-amd64 (${{ matrix.java_version }}, ${{ matrix.config }})
@@ -184,16 +184,16 @@ jobs:
           apk update && apk add curl moreutils wget hexdump linux-headers bash make g++ clang git cppcheck jq cmake gtest-dev gmock tar binutils python3 >/dev/null
           # Install debug symbols for musl libc
           apk add musl-dbg
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Cache Gradle Wrapper Binaries
-        uses: actions/cache@v5
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: ~/.gradle/wrapper/dists
           key: gradle-wrapper-${{ runner.os }}-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties') }}
           restore-keys: |
             gradle-wrapper-${{ runner.os }}-
       - name: Cache Gradle User Home
-        uses: actions/cache@v5
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: ~/.gradle/caches
           key: gradle-caches-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
@@ -256,13 +256,13 @@ jobs:
           echo "## 🔧 Unwinding Quality Report - ${{ matrix.java_version }} (amd64-musl)" >> $GITHUB_STEP_SUMMARY
           cat ddprof-test/build/reports/unwinding-summary.md >> $GITHUB_STEP_SUMMARY
       - name: Upload build artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         if: success()
         with:
           name: (build) test-linux-musl-amd64 (${{ matrix.java_version }}, ${{ matrix.config }})
           path: build/
       - name: Upload failures
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         if: failure()
         with:
           name: failures-musl-${{ matrix.java_version }}-${{ matrix.config }}-amd64
@@ -272,13 +272,13 @@ jobs:
         run: |
           .github/scripts/prepare_reports.sh
       - name: Upload unwinding reports
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         if: success() && matrix.config == 'debug'
         with:
           name: (unwinding-reports) unwinding-linux-musl-amd64 (${{ matrix.java_version }}, ${{ matrix.config }})
           path: unwinding-reports
       - name: Upload test reports
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         if: failure()
         with:
           name: (test-reports) test-linux-musl-amd64 (${{ matrix.java_version }}, ${{ matrix.config }})
@@ -309,11 +309,11 @@ jobs:
               echo "enabled=false" >> $GITHUB_OUTPUT
             fi
           fi
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         if: steps.set_enabled.outputs.enabled == 'true'
       - name: Cache Gradle Wrapper Binaries
         if: steps.set_enabled.outputs.enabled == 'true'
-        uses: actions/cache@v5
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: ~/.gradle/wrapper/dists
           key: gradle-wrapper-${{ runner.os }}-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties') }}
@@ -321,7 +321,7 @@ jobs:
             gradle-wrapper-${{ runner.os }}-
       - name: Cache Gradle User Home
         if: steps.set_enabled.outputs.enabled == 'true'
-        uses: actions/cache@v5
+        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
         with:
           path: ~/.gradle/caches
           key: gradle-caches-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
@@ -416,13 +416,13 @@ jobs:
           echo "## 🔧 Unwinding Quality Report - ${{ matrix.java_version }} (aarch64)" >> $GITHUB_STEP_SUMMARY
           cat ddprof-test/build/reports/unwinding-summary.md >> $GITHUB_STEP_SUMMARY
       - name: Upload build artifacts
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         if: success()
         with:
           name: (build) test-linux-glibc-aarch64 (${{ matrix.java_version }}, ${{ matrix.config }})
           path: build/
       - name: Upload failures
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         if: failure()
         with:
           name: failures-glibc-${{ matrix.java_version }}-${{ matrix.config }}-aarch64
@@ -432,13 +432,13 @@ jobs:
         run: |
           .github/scripts/prepare_reports.sh
       - name: Upload unwinding reports
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         if: success() && matrix.config == 'debug'
         with:
           name: (unwinding-reports) unwinding-linux-glibc-aarch64 (${{ matrix.java_version }}, ${{ matrix.config }})
           path: unwinding-reports
       - name: Upload test reports
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         if: failure()
         with:
           name: (test-reports) test-linux-glibc-aarch64 (${{ matrix.java_version }}, ${{ matrix.config }})
@@ -457,16 +457,16 @@ jobs:
        labels: arm-4core-linux-ubuntu24.04
      timeout-minutes: 180
      steps:
-       - uses: actions/checkout@v6
+       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        - name: Cache Gradle Wrapper Binaries
-         uses: actions/cache@v5
+         uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
          with:
            path: ~/.gradle/wrapper/dists
            key: gradle-wrapper-${{ runner.os }}-${{ hashFiles('gradle/wrapper/gradle-wrapper.properties') }}
            restore-keys: |
              gradle-wrapper-${{ runner.os }}-
        - name: Cache Gradle User Home
-         uses: actions/cache@v5
+         uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # v5.0.3
          with:
            path: ~/.gradle/caches
            key: gradle-caches-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
@@ -513,13 +513,13 @@ jobs:
            echo "## 🔧 Unwinding Quality Report - ${{ matrix.java_version }} (aarch64-musl)" >> $GITHUB_STEP_SUMMARY
            cat ddprof-test/build/reports/unwinding-summary.md >> $GITHUB_STEP_SUMMARY
        - name: Upload build artifacts
-         uses: actions/upload-artifact@v7
+         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
          if: success()
          with:
            name: (build) test-linux-musl-aarch64 (${{ matrix.java_version }}, ${{ matrix.config }})
            path: build/
        - name: Upload failures
-         uses: actions/upload-artifact@v7
+         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
          if: failure()
          with:
            name: failures-musl-${{ matrix.java_version }}-${{ matrix.config }}-aarch64
@@ -529,13 +529,13 @@ jobs:
          run: |
            .github/scripts/prepare_reports.sh
        - name: Upload unwinding reports
-         uses: actions/upload-artifact@v7
+         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
          if: success() && matrix.config == 'debug'
          with:
            name: (unwinding-reports) unwinding-linux-musl-aarch64 (${{ matrix.java_version }}, ${{ matrix.config }})
            path: unwinding-reports
        - name: Upload test reports
-         uses: actions/upload-artifact@v7
+         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
          if: failure()
          with:
            name: (test-reports) test-linux-musl-aarch64 (${{ matrix.java_version }}, ${{ matrix.config }})
diff --git a/.github/workflows/update_assets.yml b/.github/workflows/update_assets.yml
index fe2e1112a..9e4fc791b 100644
--- a/.github/workflows/update_assets.yml
+++ b/.github/workflows/update_assets.yml
@@ -60,7 +60,7 @@ jobs:
           mv ${LIB_BASE_DIR}/linux-x64-musl/libjavaProfiler.so assets/libjavaProfiler_linux-x64-musl.so
       - name: Update release ${{ inputs.release_tag }}
         id: update-release
-        uses: ncipollo/release-action@v1
+        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           tag: "v_${{ env.VERSION }}"
diff --git a/.github/workflows/upstream-tracker.yml b/.github/workflows/upstream-tracker.yml
index 00a123800..c85bd4ff5 100644
--- a/.github/workflows/upstream-tracker.yml
+++ b/.github/workflows/upstream-tracker.yml
@@ -19,7 +19,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup git
         run: |