diff --git a/.github/actions/msvc-env/action.yml b/.github/actions/msvc-env/action.yml
new file mode 100644
index 00000000..e996de1f
--- /dev/null
+++ b/.github/actions/msvc-env/action.yml
@@ -0,0 +1,25 @@
+name: MSVC x64 environment
+description: Load vcvars64 into the job environment so Ninja can find cl.exe.
+
+# Replaces ilammy/msvc-dev-cmd, which is stalled on Node 20. Only variables
+# that vcvars64.bat adds or changes are exported to later steps.
+runs:
+  using: composite
+  steps:
+    - shell: pwsh
+      run: |
+        $ErrorActionPreference = 'Stop'
+        $vswhere = Join-Path ${env:ProgramFiles(x86)} 'Microsoft Visual Studio\Installer\vswhere.exe'
+        $vs = & $vswhere -latest -products * -requires Microsoft.VisualStudio.Component.VC.Tools.x86.x64 -property installationPath
+        $bat = Join-Path "$vs" 'VC\Auxiliary\Build\vcvars64.bat'
+        if (-not $vs -or -not (Test-Path $bat)) { throw "vcvars64.bat not found (VS: '$vs')" }
+
+        $before = @{}
+        Get-ChildItem env: | ForEach-Object { $before[$_.Name] = $_.Value }
+        $after = cmd /c "`"$bat`" >nul && set"
+        if ($LASTEXITCODE -ne 0) { throw "vcvars64.bat failed ($LASTEXITCODE)" }
+
+        $after | ForEach-Object {
+          if ($_ -match '^([^=]+)=(.*)$' -and $before[$Matches[1]] -cne $Matches[2]) { "$($Matches[1])=$($Matches[2])" }
+        } | Out-File -Append -Encoding utf8 $env:GITHUB_ENV
+        Write-Host "Loaded MSVC x64 environment from $vs"
diff --git a/.github/workflows/bindings-sysman-python-checks.yml b/.github/workflows/bindings-sysman-python-checks.yml
index c0de93cc..379101ce 100644
--- a/.github/workflows/bindings-sysman-python-checks.yml
+++ b/.github/workflows/bindings-sysman-python-checks.yml
@@ -40,10 +40,10 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Python ${{ env.PYTHON_VERSION }}
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
 
diff --git a/.github/workflows/bindings-sysman-python-security-scan.yml b/.github/workflows/bindings-sysman-python-security-scan.yml
index 1c9880a7..bd6518c9 100644
--- a/.github/workflows/bindings-sysman-python-security-scan.yml
+++ b/.github/workflows/bindings-sysman-python-security-scan.yml
@@ -37,10 +37,10 @@ jobs:
     
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       
       - name: Set up Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.x'
       
@@ -55,7 +55,7 @@ jobs:
           bandit -r source/ test/ -ll -f screen
       
       - name: Upload Bandit results as artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: bandit-security-report
diff --git a/.github/workflows/bindings-sysman-python-unit-tests-coverage.yml b/.github/workflows/bindings-sysman-python-unit-tests-coverage.yml
index 1d399da9..3e2ec60f 100644
--- a/.github/workflows/bindings-sysman-python-unit-tests-coverage.yml
+++ b/.github/workflows/bindings-sysman-python-unit-tests-coverage.yml
@@ -40,12 +40,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0  # Full history for better coverage comparison
 
       - name: Set up Python ${{ env.PYTHON_VERSION }}
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: ${{ env.PYTHON_VERSION }}
           cache: 'pip'
@@ -285,7 +285,7 @@ jobs:
           fi
 
       - name: Upload Test Results
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: test-results-${{ github.run_number }}
@@ -298,7 +298,7 @@ jobs:
           retention-days: 30
 
       - name: Upload Coverage Reports
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         if: always()
         with:
           name: coverage-report-${{ github.run_number }}
diff --git a/.github/workflows/build-clang.yml b/.github/workflows/build-clang.yml
index fbf53632..65a7c28d 100644
--- a/.github/workflows/build-clang.yml
+++ b/.github/workflows/build-clang.yml
@@ -27,7 +27,7 @@ jobs:
         run: |
           apt-get update
           apt-get install -y clang cmake make git
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Build Loader (${{ matrix.build_type }}) with Clang on ${{ matrix.container }}
         run: |
           mkdir build
diff --git a/.github/workflows/build-msi-package.yml b/.github/workflows/build-msi-package.yml
index 1b7defae..76ffa648 100644
--- a/.github/workflows/build-msi-package.yml
+++ b/.github/workflows/build-msi-package.yml
@@ -12,11 +12,9 @@ jobs:
     if: github.repository_owner == 'oneapi-src'
     runs-on: [windows-latest]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Setup Windows build environment
-        uses: ilammy/msvc-dev-cmd@v1
-        with:
-          arch: x64
+        uses: ./.github/actions/msvc-env
       - name: Build Loader on Latest Windows
         run: |
           mkdir build
diff --git a/.github/workflows/build-multi-static.yml b/.github/workflows/build-multi-static.yml
index 9b9f3b88..d2de2da0 100644
--- a/.github/workflows/build-multi-static.yml
+++ b/.github/workflows/build-multi-static.yml
@@ -19,7 +19,7 @@ jobs:
       short-sha: ${{ steps.const.outputs.short-sha }}
       ref-slug: ${{ steps.const.outputs.ref-slug }}
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         clean: true
         ref: ${{ github.event.pull_request.head.sha }}
@@ -86,7 +86,7 @@ jobs:
         image-name=ghcr.io/${{ github.repository }}/${OS_STRING}
         ccache-dir=${CCACHE_DIR}
         EOF
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         clean: true
         fetch-depth: 0
@@ -94,7 +94,7 @@ jobs:
     - name: Create Ccache directory
       run: mkdir -p '${{ steps.const.outputs.ccache-dir }}'
     - name: Ccache
-      uses: actions/cache@v6
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ steps.const.outputs.ccache-dir }}
         key: ccache-${{ github.job }}-${{ steps.const.outputs.os-string }}${{ env.ARCH_SUFFIX }}-${{ matrix.target }}-${{ github.sha }}
@@ -137,9 +137,7 @@ jobs:
         done
     - name: Setup Windows build environment
       if: matrix.os.name == 'windows'
-      uses: ilammy/msvc-dev-cmd@v1
-      with:
-        arch: x64
+      uses: ./.github/actions/msvc-env
     - name: Build (Windows)
       if: matrix.os.name == 'windows'
       run: |
diff --git a/.github/workflows/build-multi.yml b/.github/workflows/build-multi.yml
index 4e1fef11..ec955ce7 100644
--- a/.github/workflows/build-multi.yml
+++ b/.github/workflows/build-multi.yml
@@ -19,7 +19,7 @@ jobs:
       short-sha: ${{ steps.const.outputs.short-sha }}
       ref-slug: ${{ steps.const.outputs.ref-slug }}
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         clean: true
         ref: ${{ github.event.pull_request.head.sha }}
@@ -104,7 +104,7 @@ jobs:
         image-name=ghcr.io/${{ github.repository }}/${OS_STRING}
         ccache-dir=${CCACHE_DIR}
         EOF
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         clean: true
         fetch-depth: 0
@@ -112,7 +112,7 @@ jobs:
     - name: Create Ccache directory
       run: mkdir -p '${{ steps.const.outputs.ccache-dir }}'
     - name: Ccache
-      uses: actions/cache@v6
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: ${{ steps.const.outputs.ccache-dir }}
         key: ccache-${{ github.job }}-${{ steps.const.outputs.os-string }}${{ env.ARCH_SUFFIX }}-${{ matrix.target }}-${{ github.sha }}
@@ -162,9 +162,7 @@ jobs:
         done
     - name: Setup Windows build environment
       if: matrix.os.name == 'windows'
-      uses: ilammy/msvc-dev-cmd@v1
-      with:
-        arch: x64
+      uses: ./.github/actions/msvc-env
     - name: Build (Windows)
       if: matrix.os.name == 'windows'
       run: |
diff --git a/.github/workflows/build-quick-static-n-1.yml b/.github/workflows/build-quick-static-n-1.yml
index 1b2b3af8..c38bc097 100644
--- a/.github/workflows/build-quick-static-n-1.yml
+++ b/.github/workflows/build-quick-static-n-1.yml
@@ -14,15 +14,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # Use ccache-action for ccache setup and caching
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           path: pr
-      - uses: hendrikmuhs/ccache-action@v1
+      - uses: hendrikmuhs/ccache-action@f09c25b45002a07be2955cbe52e8cee55643f89d # v1.2.24
 
       # Checkout master branch for static loader source
       - name: Checkout master branch for static loader
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: master
           fetch-depth: 0
@@ -73,23 +73,21 @@ jobs:
     runs-on: windows-latest
     steps:
       # Checkout PR branch (dynamic loader source)
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
           path: pr
 
       # Checkout master branch for static loader source
       - name: Checkout master branch for static loader
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: master
           fetch-depth: 0
           path: master
 
       - name: Setup Windows build environment
-        uses: ilammy/msvc-dev-cmd@v1
-        with:
-          arch: x64
+        uses: ./pr/.github/actions/msvc-env
 
       # Build static loader from master branch
       - name: Build Static Loader from master
diff --git a/.github/workflows/build-quick-static.yml b/.github/workflows/build-quick-static.yml
index 0680955a..09ae1b31 100644
--- a/.github/workflows/build-quick-static.yml
+++ b/.github/workflows/build-quick-static.yml
@@ -12,8 +12,8 @@ jobs:
     if: github.repository_owner == 'oneapi-src'
     runs-on: [ubuntu-latest]
     steps:
-      - uses: actions/checkout@v7
-      - uses: hendrikmuhs/ccache-action@v1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: hendrikmuhs/ccache-action@f09c25b45002a07be2955cbe52e8cee55643f89d # v1.2.24
       - name: Build Static Loader on Latest Ubuntu
         run: |
           mkdir build
@@ -48,11 +48,9 @@ jobs:
     if: github.repository_owner == 'oneapi-src'
     runs-on: [windows-latest]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Setup Windows build environment
-        uses: ilammy/msvc-dev-cmd@v1
-        with:
-          arch: x64
+        uses: ./.github/actions/msvc-env
       - name: Build Static Loader on Latest Windows
         run: |
           mkdir build
diff --git a/.github/workflows/build-quick.yml b/.github/workflows/build-quick.yml
index 7aab2abb..23764f56 100644
--- a/.github/workflows/build-quick.yml
+++ b/.github/workflows/build-quick.yml
@@ -31,7 +31,7 @@ jobs:
             apt-get update
             apt-get install -y build-essential cmake git
           fi
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Build Loader on ${{ matrix.container }}
         run: |
           mkdir build
@@ -71,11 +71,9 @@ jobs:
     if: github.repository_owner == 'oneapi-src'
     runs-on: [windows-latest]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Setup Windows build environment
-        uses: ilammy/msvc-dev-cmd@v1
-        with:
-          arch: x64
+        uses: ./.github/actions/msvc-env
       - name: Build Loader on Latest Windows
         run: |
           mkdir build
diff --git a/.github/workflows/check-abi.yml b/.github/workflows/check-abi.yml
index 6585201e..165c4011 100644
--- a/.github/workflows/check-abi.yml
+++ b/.github/workflows/check-abi.yml
@@ -16,21 +16,21 @@ jobs:
       run: |
         sudo apt update
         sudo apt install -y elfutils universal-ctags vtable-dumper
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 0 # Required due to the way Git works, without it this action won't be able to find any or the correct tags
-    - uses: actions-ecosystem/action-get-latest-tag@v1
+    - uses: actions-ecosystem/action-get-latest-tag@b7c32daec3395a9616f88548363a42652b22d435 # v1.6.0
       id: get-latest-tag
       with:
         semver_only: true
     - name: Checkout base
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         ref: ${{ steps.get-latest-tag.outputs.tag }}
         clean: true
         path: base
     - name: Checkout head
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         clean: true
         path: head
@@ -78,7 +78,7 @@ jobs:
           -old base.dump \
           -new head.dump \
           -report-path release_report.html
-    - uses: actions/upload-artifact@v7
+    - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       if: always()
       with:
         name: abi-report-last-release
@@ -92,13 +92,13 @@ jobs:
         sudo apt update
         sudo apt install -y elfutils universal-ctags vtable-dumper
     - name: Checkout base
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         ref: ${{ github.base_ref }}
         clean: true
         path: base
     - name: Checkout head
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         clean: true
         path: head
@@ -146,7 +146,7 @@ jobs:
           -old base.dump \
           -new head.dump \
           -report-path master_report.html
-    - uses: actions/upload-artifact@v7
+    - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       if: always()
       with:
         name: abi-report-master
diff --git a/.github/workflows/codespell-comment.yml b/.github/workflows/codespell-comment.yml
index 6f7ba9a3..40d5b229 100644
--- a/.github/workflows/codespell-comment.yml
+++ b/.github/workflows/codespell-comment.yml
@@ -27,14 +27,14 @@ jobs:
     if: github.event.workflow_run.event == 'pull_request'
     steps:
     - name: Download report
-      uses: actions/download-artifact@v8
+      uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
       continue-on-error: true
       with:
         name: codespell-report
         run-id: ${{ github.event.workflow_run.id }}
         github-token: ${{ secrets.GITHUB_TOKEN }}
     - name: Post or update PR comment
-      uses: actions/github-script@v9
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       with:
         script: |
           const fs = require('fs');
diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml
index 0b9d6b45..29e8dc4f 100644
--- a/.github/workflows/codespell.yml
+++ b/.github/workflows/codespell.yml
@@ -19,8 +19,8 @@ jobs:
   codespell:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v7
-    - uses: actions/setup-python@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: '3.x'
     - name: Install codespell
@@ -40,7 +40,7 @@ jobs:
       run: echo "${{ github.event.number }}" > pr_number.txt
     - name: Upload report
       # Consumed by the "Codespell Comment" workflow to post the PR comment.
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
         name: codespell-report
         path: |
diff --git a/.github/workflows/regen-source.yml b/.github/workflows/regen-source.yml
index ec11136b..a3e78971 100644
--- a/.github/workflows/regen-source.yml
+++ b/.github/workflows/regen-source.yml
@@ -40,7 +40,7 @@ jobs:
           # Floor kept in step with the spec repository's third_party/requirements.txt;
           # verified to produce byte-identical output from 1.3.3 through 1.3.11.
           pip3 install --break-system-packages "Mako>=1.3.3"
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Regenerate sources from archived spec metadata
         run: python3 scripts/spec_metadata.py regen
@@ -66,7 +66,7 @@ jobs:
 
       - name: Upload drift report
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: regen-diff-linux
           path: regen.diff
@@ -105,17 +105,15 @@ jobs:
     if: github.repository_owner == 'oneapi-src'
     runs-on: [windows-latest]
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
         with:
           python-version: '3.x'
       - name: Install dependencies
         # See the Linux job for why this tracks the spec's requirements.txt.
         run: pip install "Mako>=1.3.3"
       - name: Setup Windows build environment
-        uses: ilammy/msvc-dev-cmd@v1
-        with:
-          arch: x64
+        uses: ./.github/actions/msvc-env
 
       - name: Regenerate sources from archived spec metadata
         run: python3 scripts/spec_metadata.py regen
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index fb34825b..324a8885 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -26,11 +26,11 @@ jobs:
       id-token: write
     steps:
     - name: "Checkout code"
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         persist-credentials: false
     - name: "Run analysis"
-      uses: ossf/scorecard-action@v2.4.4
+      uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
       with:
         results_file: results.sarif
         results_format: sarif
@@ -41,12 +41,12 @@ jobs:
         repo_token: ${{ secrets.SCORECARD_TOKEN }}
         publish_results: true
     - name: "Upload artifact"
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
       with:
         name: SARIF file
         path: results.sarif
     - name: "Upload to code-scanning"
       if: github.event_name != 'pull_request'
-      uses: github/codeql-action/upload-sarif@v4
+      uses: github/codeql-action/upload-sarif@2892aa5e19bbd11bc0cff5427e3b750a04d9e3c2 # v4.38.2
       with:
         sarif_file: results.sarif
diff --git a/.github/workflows/update-spec.yml b/.github/workflows/update-spec.yml
index 4ee217b6..42d43c72 100644
--- a/.github/workflows/update-spec.yml
+++ b/.github/workflows/update-spec.yml
@@ -33,20 +33,20 @@ jobs:
   generate-code:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/setup-python@v7
+    - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: '3.x'
     - name: Install dependencies
       # Kept in step with the spec repository's third_party/requirements.txt, since
       # this job runs that repository's generators.
       run: pip install "Mako>=1.3.3" "PyYAML>=6.0.1"
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         clean: true
         fetch-depth: 0
         fetch-tags: true
         # Fall back to the default token when the push secret is unavailable
-        # (e.g. pull_request runs), otherwise checkout@v5 rejects an empty token.
+        # (e.g. pull_request runs), otherwise checkout rejects an empty token.
         token: ${{ secrets.TOKEN || github.token }}
     - name: Checkout develop branch or create local version
       if: ${{ github.event_name == 'workflow_dispatch' }}
@@ -55,7 +55,7 @@ jobs:
       if: ${{ github.event_name == 'workflow_dispatch' }}
       run: git reset --hard origin/master
     - name: Checkout spec repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         repository: ${{ github.event_name == 'pull_request' && 'oneapi-src/level-zero-spec' || inputs.repository }}
         clean: true