diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 025400e..053a8ea 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -24,12 +24,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo 🛎
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
           fetch-depth: 0
 
       - name: Lint Code Base 🕵🏻‍♀️
-        uses: super-linter/super-linter/slim@v8
+        uses: super-linter/super-linter/slim@d24d9629088c26de5cc684fbe17d1843469c37e0 # v8
         env:
           LINTER_RULES_PATH: /
           VALIDATE_ALL_CODEBASE: false
@@ -50,17 +50,17 @@ jobs:
           - 1.26.1
     steps:
       - name: Checkout Repo 🛎
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
       - name: Setup Go 🐹
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version: ${{ matrix.go-version }}
           cache: true
           cache-dependency-path: go.sum
 
       - name: Lint Go Code 🕵🏻‍♂️
-        uses: golangci/golangci-lint-action@v8
+        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8
         with:
           version: latest
           only-new-issues: false
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f83692f..7d49212 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -27,26 +27,26 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo 🛎
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
           fetch-depth: 0
 
       - name: Setup Go 🐹
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version: 1.26.1
           cache: true
           cache-dependency-path: go.sum
 
       - name: Log in to the Container registry 🗝
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Run GoReleaser 🚀
-        uses: goreleaser/goreleaser-action@v6
+        uses: goreleaser/goreleaser-action@e435ccd777264be153ace6237001ef4d979d3a7a # v6
         with:
           distribution: goreleaser
           version: latest
@@ -89,7 +89,7 @@ jobs:
       contents: write # To upload assets to release.
       actions: read # To read the workflow path.
     needs: args
-    uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.5.0
+    uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@7f4fdb871876c23e455853d694197440c5a91506 # v1.5.0
     with:
       go-version: "1.23"
       # Optional: only needed if using ldflags.
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index b401cc5..4225457 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -31,29 +31,29 @@ jobs:
         shell: bash
     steps:
       - name: Checkout Repo 🛎
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
       - name: Setup Go 🐹
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version: ${{ matrix.go-version }}
           cache: true
           cache-dependency-path: go.sum
 
       - name: Setup R required for tests
-        uses: r-lib/actions/setup-r@v2
+        uses: r-lib/actions/setup-r@6f6e5bc62fba3a704f74e7ad7ef7676c5c6a2590 # v2
 
       - name: Run Tests 🧨
         run: make test
 
       - name: Check whether JUnit XML report exists 🚦
         id: check-junit-xml
-        uses: andstor/file-existence-action@v3
+        uses: andstor/file-existence-action@558493d6c74bf472d87c84eab196434afc2fa029 # v3
         with:
           files: junit-report.xml
 
       - name: Publish Unit Test Summary 📑
-        uses: EnricoMi/publish-unit-test-result-action@v2
+        uses: EnricoMi/publish-unit-test-result-action@2ceeed2b8f26e15b06c3846719f75354febd9e7b # v2
         id: test-results
         if: steps.check-junit-xml.outputs.files_exists == 'true' && github.event_name == 'pull_request'
         with:
@@ -62,7 +62,7 @@ jobs:
 
       - name: Check whether coverage reports exists 💭
         id: check-coverage-reports
-        uses: andstor/file-existence-action@v3
+        uses: andstor/file-existence-action@558493d6c74bf472d87c84eab196434afc2fa029 # v3
         with:
           files: >-
             coverage.xml,
@@ -83,7 +83,7 @@ jobs:
 
       - name: Upload report 🔼
         if: steps.check-coverage-reports.outputs.files_exists == 'true'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: coverage-report
           path: |
@@ -99,10 +99,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo 🛎
-        uses: actions/checkout@v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
 
       - name: Setup Go 🐹
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6
         with:
           go-version: ${{ matrix.go-version }}
           cache: true