diff --git a/.github/workflows/benchmarks.yml b/.github/workflows/benchmarks.yml
index c5a6f3f0..840236bb 100644
--- a/.github/workflows/benchmarks.yml
+++ b/.github/workflows/benchmarks.yml
@@ -17,11 +17,11 @@ jobs:
     # run  either when pull request is opened or when comment body (only on pr) is /run-bench
     if: (github.event_name == 'pull_request') || ((github.event.issue.pull_request != null) && github.event.comment.body == '/run-bench')
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           submodules: true
-      - name: Setup Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+      - name: Obtain Rust
+        run: rustup override set stable
       - name: Install hyperfine
         run: cargo install hyperfine
       - name: Install cmake
@@ -31,7 +31,7 @@ jobs:
       - name: Run Benchmarks
         run: make bench-all
       - name: Post result comment
-        uses: mshick/add-pr-comment@v3
+        uses: mshick/add-pr-comment@8e4927817251f1ff60c001f04568532b38e0b4a0 # v3.11.0
         with:
           message-path: bench-output.md
         continue-on-error: true
diff --git a/.github/workflows/codspeed.yml b/.github/workflows/codspeed.yml
index 4be2624a..34b4492d 100644
--- a/.github/workflows/codspeed.yml
+++ b/.github/workflows/codspeed.yml
@@ -16,7 +16,7 @@ jobs:
     name: Run benchmarks
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           submodules: true
       - name: Obtain Rust
@@ -26,7 +26,7 @@ jobs:
       - name: Build benchmarks
         run: cargo codspeed build
       - name: Run the benchmarks
-        uses: CodSpeedHQ/action@v4.10.4
+        uses: CodSpeedHQ/action@fa0c9b1770f933c1bc025c83a9b42946b102f4e6 # v4.10.4
         with:
           mode: instrumentation
           run: cargo codspeed run
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index acf1eebb..164c89f8 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -6,9 +6,10 @@ jobs:
   fuzz-build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           submodules: true
-      - uses: dtolnay/rust-toolchain@nightly
+      - name: Obtain Rust
+        run: rustup override set nightly
       - run: cargo install cargo-fuzz
       - run: cargo fuzz build
diff --git a/.github/workflows/msrv.yml b/.github/workflows/msrv.yml
index 1e2906bc..284f8086 100644
--- a/.github/workflows/msrv.yml
+++ b/.github/workflows/msrv.yml
@@ -6,5 +6,5 @@ jobs:
   ensure_msrv:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
     - run: script/check-msrv-matches-workflow
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 84ccaf8b..40dceb95 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -21,7 +21,7 @@ jobs:
             version: ${{ steps.version-label.outputs.version }}
 
         steps:
-            - uses: actions/checkout@v5
+            - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
               with:
                   submodules: true
 
@@ -79,7 +79,7 @@ jobs:
 
             - name: Create Pull Request
               id: cpr
-              uses: peter-evans/create-pull-request@v8.1.0
+              uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
               with:
                   commit-message: "CHANGELOG.md: add generated portion."
                   title: "Release v${{ steps.version-label.outputs.version }}."
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 4e88befb..f1e7e754 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -16,7 +16,7 @@ jobs:
           - stable
           - $MSRV
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       with:
         submodules: true
     - name: Obtain Rust
@@ -39,7 +39,7 @@ jobs:
           - stable
           - $MSRV
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       with:
         submodules: true
     - name: Obtain Rust
@@ -58,7 +58,7 @@ jobs:
           - stable
           - $MSRV
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       with:
         submodules: true
     - name: Obtain Rust
@@ -77,7 +77,7 @@ jobs:
           - stable
           - $MSRV
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       with:
         submodules: true
     - name: Obtain Rust
@@ -94,7 +94,7 @@ jobs:
           - stable
           - $MSRV
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       with:
         submodules: true
     - name: Obtain Rust
@@ -104,7 +104,7 @@ jobs:
   clippy_format:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       with:
         submodules: true
     - name: Obtain Rust
diff --git a/.github/workflows/semgrep.yml b/.github/workflows/semgrep.yml
index c77ad38b..cbebd00e 100644
--- a/.github/workflows/semgrep.yml
+++ b/.github/workflows/semgrep.yml
@@ -23,5 +23,5 @@ jobs:
       image: semgrep/semgrep
     if: (github.actor != 'dependabot[bot]')
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - run: semgrep ci --exclude=www
diff --git a/.github/workflows/typos.yml b/.github/workflows/typos.yml
index 7b6b28e0..5f180e69 100644
--- a/.github/workflows/typos.yml
+++ b/.github/workflows/typos.yml
@@ -7,5 +7,5 @@ jobs:
     name: 'Check for spelling errors'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-      - uses: crate-ci/typos@master
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+      - uses: crate-ci/typos@78bc6fb2c0d734235d57a2d6b9de923cc325ebdd # v1.43.4