diff --git a/.github/workflows/budibase_ci.yml b/.github/workflows/budibase_ci.yml
index 60228369c0..be7d786b49 100644
--- a/.github/workflows/budibase_ci.yml
+++ b/.github/workflows/budibase_ci.yml
@@ -187,7 +187,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Use Node.js 22.x
-        uses: azure/setup-helm@v3
+        uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78  # v3
       - run: cd charts/budibase && helm lint .
 
   test-libraries:
@@ -447,7 +447,7 @@ jobs:
       - name: Load dotenv
         if: needs.compute-affected-jobs.outputs.run_server_tests == 'true'
         id: dotenv
-        uses: falti/dotenv-action@v1.2.0
+        uses: falti/dotenv-action@73fafca04177425fd3e0a0849257015ae9d42034  # v1.2.0
         with:
           path: ./packages/server/images-sha.env
 
diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml
index f96d8da1da..986728b640 100644
--- a/.github/workflows/cla.yml
+++ b/.github/workflows/cla.yml
@@ -14,7 +14,7 @@ jobs:
       - name: "CLA Assistant"
         if: (github.event.comment.body == 'recheck' || github.event.comment.body == 'I have read the CLA Document and I hereby sign the CLA') || github.event_name == 'pull_request_target'
         # Beta Release
-        uses: cla-assistant/github-action@v2.1.2-beta
+        uses: cla-assistant/github-action@948230deb0d44dd38957592f08c6bd934d96d0cf  # v2.1.2-beta
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           # the below token should have repo scope and must be manually added by you in the repository's secret
diff --git a/.github/workflows/close-featurebranch.yml b/.github/workflows/close-featurebranch.yml
index babf9d8d73..1fbe63b1b9 100644
--- a/.github/workflows/close-featurebranch.yml
+++ b/.github/workflows/close-featurebranch.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: passeidireto/trigger-external-workflow-action@main
+      - uses: passeidireto/trigger-external-workflow-action@d78a1f58cb96f3a637e37da56b8714f5a92c9d34  # main
         env:
           PAYLOAD_BRANCH: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.BRANCH || github.head_ref }}
           PAYLOAD_PR_NUMBER: ${{ github.event.pull_request.number }}
diff --git a/.github/workflows/deploy-featurebranch.yml b/.github/workflows/deploy-featurebranch.yml
index 4ea6641840..627f5b1b4a 100644
--- a/.github/workflows/deploy-featurebranch.yml
+++ b/.github/workflows/deploy-featurebranch.yml
@@ -34,7 +34,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: passeidireto/trigger-external-workflow-action@main
+      - uses: passeidireto/trigger-external-workflow-action@d78a1f58cb96f3a637e37da56b8714f5a92c9d34  # main
         with:
           repository: budibase/featurebranches
           event: featurebranch-qa-deploy
diff --git a/.github/workflows/deploy-qa.yml b/.github/workflows/deploy-qa.yml
index 1339ad2eb9..e97c6077bc 100644
--- a/.github/workflows/deploy-qa.yml
+++ b/.github/workflows/deploy-qa.yml
@@ -10,7 +10,7 @@ jobs:
   trigger-deploy-to-qa-env:
     runs-on: ubuntu-latest
     steps:
-      - uses: peter-evans/repository-dispatch@v2
+      - uses: peter-evans/repository-dispatch@bf47d102fdb849e755b0b0023ea3e81a44b6f570  # v2
         with:
           repository: budibase/budibase-deploys
           event-type: budicloud-qa-deploy
diff --git a/.github/workflows/force-release.yml b/.github/workflows/force-release.yml
index 3d96d51484..45e83f390e 100644
--- a/.github/workflows/force-release.yml
+++ b/.github/workflows/force-release.yml
@@ -35,7 +35,7 @@ jobs:
     needs: [ensure-is-master-tag]
     runs-on: ubuntu-latest
     steps:
-      - uses: peter-evans/repository-dispatch@v2
+      - uses: peter-evans/repository-dispatch@bf47d102fdb849e755b0b0023ea3e81a44b6f570  # v2
         with:
           repository: budibase/budibase-deploys
           event-type: release-prod
diff --git a/.github/workflows/helm-validate.yml b/.github/workflows/helm-validate.yml
index edf829d113..da0783969a 100644
--- a/.github/workflows/helm-validate.yml
+++ b/.github/workflows/helm-validate.yml
@@ -15,7 +15,7 @@ jobs:
           fetch-depth: 0
 
       - name: Set up Helm
-        uses: azure/setup-helm@v3
+        uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78  # v3
         with:
           version: v3.17.3
 
@@ -29,7 +29,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Set up Helm
-        uses: azure/setup-helm@v3
+        uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78  # v3
         with:
           version: v3.17.3
 
@@ -51,12 +51,12 @@ jobs:
           fetch-depth: 0
 
       - name: Set up Helm
-        uses: azure/setup-helm@v3
+        uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78  # v3
         with:
           version: v3.17.3
 
       - name: Set up chart-testing
-        uses: helm/chart-testing-action@v2
+        uses: helm/chart-testing-action@6ec842c01de15ebb84c8627d2744a0c2f2755c9f  # v2
 
       - name: Add helm repositories
         run: helm repo add couchdb https://apache.github.io/couchdb-helm
@@ -87,7 +87,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Set up Helm
-        uses: azure/setup-helm@v3
+        uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78  # v3
         with:
           version: v3.17.3
 
@@ -116,7 +116,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Set up Helm
-        uses: azure/setup-helm@v3
+        uses: azure/setup-helm@5119fcb9089d432beecbf79bb2c7915207344b78  # v3
         with:
           version: v3.17.3
 
diff --git a/.github/workflows/pr-labeler.yml b/.github/workflows/pr-labeler.yml
index d56252e7b9..c8a4c5d442 100644
--- a/.github/workflows/pr-labeler.yml
+++ b/.github/workflows/pr-labeler.yml
@@ -12,7 +12,7 @@ jobs:
   size-labeler:
     runs-on: ubuntu-latest
     steps:
-      - uses: codelytv/pr-size-labeler@v1
+      - uses: codelytv/pr-size-labeler@095a41fca88b8764fd9e008ad269bcdb82bb38b9  # v1
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           xs_max_size: "10"
diff --git a/.github/workflows/tag-release.yml b/.github/workflows/tag-release.yml
index 84f4b8277b..784ae8bf6a 100644
--- a/.github/workflows/tag-release.yml
+++ b/.github/workflows/tag-release.yml
@@ -56,7 +56,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
 
-      - uses: peter-evans/repository-dispatch@v2
+      - uses: peter-evans/repository-dispatch@bf47d102fdb849e755b0b0023ea3e81a44b6f570  # v2
         with:
           repository: budibase/budibase-deploys
           event-type: release-prod