diff --git a/.github/workflows/commit.yml b/.github/workflows/commit.yml
index 9f61310a..1d731e7d 100644
--- a/.github/workflows/commit.yml
+++ b/.github/workflows/commit.yml
@@ -11,8 +11,8 @@ jobs:
       contents: read
       pull-requests: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
-      - uses: 1Password/check-signed-commits-action@v1
+      - uses: 1Password/check-signed-commits-action@ed2885f3ed2577a4f5d3c3fe895432a557d23d52 # v1
 
-      - uses: wagoid/commitlint-github-action@v6
+      - uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 224b26c1..60d54501 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -11,23 +11,23 @@ jobs:
     name: Lint
     runs-on: ubuntu-latest
     steps:
-      - uses: jlumbroso/free-disk-space@v1.3.1
+      - uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
       - name: setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version-file: go.mod
 
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v9
+        uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9
         with:
           version: v2.12.2
           only-new-issues: true
 
       - name: megalinter
-        uses: oxsecurity/megalinter@v9
+        uses: oxsecurity/megalinter@0e3ce9b9c8c10effb9b269509cc47ca17cae31c7 # v9
         if: ${{ (github.event_name == 'push' && github.ref == 'refs/heads/main') }}
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 1643e952..102a495f 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -13,6 +13,6 @@ jobs:
     name: Pre-commit Checks
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
 
-      - uses: j178/prek-action@v2
+      - uses: j178/prek-action@bdca6f102f98e2b4c7029491a53dfd366469e33d # v2
diff --git a/.github/workflows/release-please.yaml b/.github/workflows/release-please.yaml
index da8fff44..73c14a5b 100644
--- a/.github/workflows/release-please.yaml
+++ b/.github/workflows/release-please.yaml
@@ -12,13 +12,13 @@ jobs:
   release-please:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/create-github-app-token@v3
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
         id: app-token
         with:
           app-id: ${{ secrets.DEVSY_GITHUB_APP_ID }}
           private-key: ${{ secrets.DEVSY_GITHUB_APP_PRIVATE_KEY }}
 
-      - uses: googleapis/release-please-action@v4
+      - uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4
         id: release
         with:
           config-file: release-please-config.json
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 3ed95ec7..0b2c66aa 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -11,18 +11,18 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           fetch-depth: 0
 
       - name: setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16 # v6
         with:
           go-version-file: go.mod
 
       - name: run goreleaser
         id: goreleaser
-        uses: goreleaser/goreleaser-action@v7
+        uses: goreleaser/goreleaser-action@5daf1e915a5f0af01ddbcd89a43b8061ff4f1a89 # v7
         with:
           version: "~> v2"
           args: release --clean
@@ -33,7 +33,7 @@ jobs:
         run: go run ./hack/provider/main.go ${{ fromJSON(steps.goreleaser.outputs.metadata).tag }} > ./dist/provider.yaml
 
       - name: upload provider.yaml
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@718ea10b132b3b2eba29c1007bb80653f286566b # v3
         with:
           tag_name: ${{ fromJSON(steps.goreleaser.outputs.metadata).tag }}
           files: ./dist/provider.yaml
diff --git a/.github/workflows/workflow-approval.yml b/.github/workflows/workflow-approval.yml
index 363e137b..63d977e5 100644
--- a/.github/workflows/workflow-approval.yml
+++ b/.github/workflows/workflow-approval.yml
@@ -10,13 +10,13 @@ jobs:
     name: Approve Workflows
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/create-github-app-token@v3
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3
         id: app-token
         with:
           app-id: ${{ secrets.DEVSY_GITHUB_APP_ID }}
           private-key: ${{ secrets.DEVSY_GITHUB_APP_PRIVATE_KEY }}
 
-      - uses: mheap/automatic-approve-action@v1
+      - uses: mheap/automatic-approve-action@851272ecb1e93d215b9ab3c16278d434a4fd775b # v1
         with:
           token: ${{ steps.app-token.outputs.token }}
           workflows: "commit.yml,lint.yml,pre-commit.yml"
diff --git a/renovate.json b/renovate.json
index db652efd..bfa4120f 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,55 +1,40 @@
 {
-    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-    "automerge": false,
-    "automergeType": "pr",
-    "automergeStrategy": "squash",
-    "extends": [
-        "config:recommended"
-    ],
-    "pre-commit": {
-        "enabled": true
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:best-practices", "helpers:pinGitHubActionDigests"],
+  "automerge": false,
+  "automergeType": "pr",
+  "automergeStrategy": "squash",
+  "pre-commit": {
+    "enabled": true
+  },
+  "dependencyDashboard": false,
+  "prConcurrentLimit": 1,
+  "platformAutomerge": true,
+  "postUpdateOptions": ["gomodTidy"],
+  "packageRules": [
+    {
+      "matchUpdateTypes": ["major"],
+      "automerge": false,
+      "prPriority": -1
     },
-    "dependencyDashboard": false,
-    "prConcurrentLimit": 1,
-    "platformAutomerge": true,
-    "postUpdateOptions": [
-        "gomodTidy"
-    ],
-    "packageRules": [
-        {
-            "matchUpdateTypes": [
-                "major"
-            ],
-            "automerge": false,
-            "prPriority": -1
-        },
-        {
-            "matchUpdateTypes": [
-                "minor",
-                "patch"
-            ],
-            "prPriority": 10
-        },
-        {
-            "matchManagers": [
-                "github-actions"
-            ],
-            "automerge": true,
-            "prPriority": 5
-        },
-        {
-            "matchManagers": [
-                "pre-commit"
-            ],
-            "automerge": true,
-            "prPriority": 4
-        },
-        {
-            "matchManagers": [
-                "gomod"
-            ],
-            "automerge": true,
-            "prPriority": 3
-        }
-    ]
+    {
+      "matchUpdateTypes": ["minor", "patch"],
+      "prPriority": 10
+    },
+    {
+      "matchManagers": ["github-actions"],
+      "automerge": true,
+      "prPriority": 5
+    },
+    {
+      "matchManagers": ["pre-commit"],
+      "automerge": true,
+      "prPriority": 4
+    },
+    {
+      "matchManagers": ["gomod"],
+      "automerge": true,
+      "prPriority": 3
+    }
+  ]
 }