diff --git a/.github/workflows/cleanup.yaml b/.github/workflows/cleanup.yaml
index 3c749d4e1..0c34c788d 100644
--- a/.github/workflows/cleanup.yaml
+++ b/.github/workflows/cleanup.yaml
@@ -29,9 +29,9 @@ jobs:
     timeout-minutes: 30
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: "22.x"
           cache: "npm"
@@ -40,7 +40,7 @@ jobs:
         run: npm ci --no-audit
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v5
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5
         with:
           # The role is set up via https://github.com/hello-nrfcloud/ci
           # secrets.AWS_ACCOUNT_ID_CI is an organization secret
@@ -76,15 +76,15 @@ jobs:
     timeout-minutes: 5
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: "22.x"
           cache: "npm"
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v5
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5
         with:
           # The role is set up via https://github.com/hello-nrfcloud/ci
           # secrets.AWS_ACCOUNT_ID_CI is an organization secret
diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index 16c90dd51..6172744d1 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -61,7 +61,7 @@ jobs:
           docker pull ${{ env.REGISTRY }}/${{ github.repository }}/${{ matrix.image }}:${{ matrix.tag }}
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v5
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5
         with:
           role-to-assume: ${{ secrets.AWS_ROLE }}
           aws-region: ${{ vars.AWS_REGION }}
@@ -116,7 +116,7 @@ jobs:
       MQTT_BRIDGE_CONTAINER_TAG: ${{ github.event.inputs.mqtt_bridge_tag }}
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
           ref: ${{ github.event.inputs.ref }}
 
@@ -127,12 +127,12 @@ jobs:
           VERSION=`git describe --abbrev=0 --tags --always | tr -d '\n'`
           echo "VERSION=$VERSION" >> $GITHUB_ENV
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: "22.x"
           cache: "npm"
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version: "^1.21.6"
 
@@ -140,7 +140,7 @@ jobs:
         run: npm ci --no-audit
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v5
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5
         with:
           role-to-assume: ${{ secrets.AWS_ROLE }}
           aws-region: ${{ vars.AWS_REGION }}
diff --git a/.github/workflows/test-and-release.yaml b/.github/workflows/test-and-release.yaml
index 21f488281..0d4d04afa 100644
--- a/.github/workflows/test-and-release.yaml
+++ b/.github/workflows/test-and-release.yaml
@@ -27,9 +27,9 @@ jobs:
     runs-on: ubuntu-24.04
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: "22.x"
           cache: "npm"
@@ -63,9 +63,9 @@ jobs:
       requestsTableName: ${{ steps.create.outputs.requestsTableName }}
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: "22.x"
           cache: "npm"
@@ -74,7 +74,7 @@ jobs:
         run: npm ci --no-audit
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v5
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5
         with:
           # The role is set up via https://github.com/hello-nrfcloud/ci
           # secrets.AWS_ACCOUNT_ID_CI is an organization secret
@@ -125,9 +125,9 @@ jobs:
       tag: ${{ steps.build.outputs.tag }}
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: "22.x"
           cache: "npm"
@@ -136,7 +136,7 @@ jobs:
         run: npm ci --no-audit
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v5
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5
         with:
           # The role is set up via https://github.com/hello-nrfcloud/ci
           # secrets.AWS_ACCOUNT_ID_CI is an organization secret
@@ -181,18 +181,18 @@ jobs:
       HTTP_API_MOCK_API_URL: ${{ needs.http-api-mock.outputs.apiURL }}
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
       - name: store checkout out version
         id: ref
         run: echo "ref=${{ github.sha }}" >> $GITHUB_OUTPUT
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: "22.x"
           cache: "npm"
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version: "^1.21.6"
 
@@ -200,7 +200,7 @@ jobs:
         run: npm ci --no-audit
 
       - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v5
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708 # v5
         with:
           # The role is set up via https://github.com/hello-nrfcloud/ci
           # secrets.AWS_ACCOUNT_ID_CI is an organization secret
@@ -245,7 +245,7 @@ jobs:
           --no-warnings ./feature-runner/console-reporter.ts  --only-failed
           --with-timestamps
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         if: failure()
         with:
           name: e2e-test-result-${{ github.sha }}
@@ -261,7 +261,7 @@ jobs:
           node --experimental-transform-types ./aws/export-logs.ts ${{ env.STACK_NAME }}
           node --experimental-transform-types ./aws/export-logs.ts ${{ needs.http-api-mock.outputs.stackName }}
 
-      - uses: actions/upload-artifact@v4
+      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         if: failure()
         with:
           name: logs-${{ github.sha }}
@@ -290,11 +290,11 @@ jobs:
       version: ${{ steps.version.outputs.version }}
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
           ref: ${{ needs.e2e-tests.outputs.ref }}
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5
         with:
           node-version: "22.x"
           cache: "npm"
diff --git a/.github/workflows/update-repo-info.yaml b/.github/workflows/update-repo-info.yaml
index 17e36658b..dfa8d365e 100644
--- a/.github/workflows/update-repo-info.yaml
+++ b/.github/workflows/update-repo-info.yaml
@@ -17,7 +17,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
       - name: Sync repository description
         run: