diff --git a/.github/workflows/agents-validate.yaml b/.github/workflows/agents-validate.yaml
index ee5e246f..fda8bdc7 100644
--- a/.github/workflows/agents-validate.yaml
+++ b/.github/workflows/agents-validate.yaml
@@ -33,7 +33,7 @@ jobs:
           submodules: true
 
       - name: Install yq
-        uses: mikefarah/yq@v4
+        uses: mikefarah/yq@v4.52.5
 
       - name: Validate agent instructions and skills
         run: ./scripts/workflows/agents-validate_agents-instructions-check.sh
diff --git a/.github/workflows/codeql.yaml b/.github/workflows/codeql.yaml
index 5a489a2d..89aeb061 100644
--- a/.github/workflows/codeql.yaml
+++ b/.github/workflows/codeql.yaml
@@ -60,7 +60,7 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
+      uses: github/codeql-action/init@v4.35.1
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
@@ -88,6 +88,6 @@ jobs:
         exit 1
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@v4.35.1
       with:
         category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/dependabot-autobump.yaml b/.github/workflows/dependabot-autobump.yaml
index 9d9c94e6..deb43d05 100644
--- a/.github/workflows/dependabot-autobump.yaml
+++ b/.github/workflows/dependabot-autobump.yaml
@@ -38,7 +38,7 @@ jobs:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Install yq
-        uses: mikefarah/yq@v4
+        uses: mikefarah/yq@v4.52.5
 
       - name: Check if auto-bump already applied
         id: check_autobump
diff --git a/.github/workflows/docs-bump.yaml b/.github/workflows/docs-bump.yaml
index 6746f819..50623dc0 100644
--- a/.github/workflows/docs-bump.yaml
+++ b/.github/workflows/docs-bump.yaml
@@ -19,7 +19,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Install yq
-        uses: mikefarah/yq@v4
+        uses: mikefarah/yq@v4.52.5
 
       - name: Version Bump
         run: ./scripts/workflows/docs-bump_docs-bump_version-bump.sh
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 6b51dd1a..393b0469 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -48,7 +48,7 @@ jobs:
           ref: ${{ github.event_name == 'workflow_dispatch' && (inputs.target_commitish != '' && inputs.target_commitish || github.sha) || github.sha }}
 
       - name: Install yq
-        uses: mikefarah/yq@v4
+        uses: mikefarah/yq@v4.52.5
 
       - name: Build candidate metadata
         id: meta