diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d35ab2787..a7b9b26e6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -6,31 +6,25 @@ on:
   pull_request:
     branches: [main]
 
-env:
-  YARN_ENABLE_GLOBAL_CACHE: false
-
 jobs:
   commit-lint:
     name: Commit Lint
     runs-on: ubuntu-latest
     if: github.event_name == 'pull_request'
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           fetch-depth: 0
-      - uses: wagoid/commitlint-github-action@v6
+      - uses: wagoid/commitlint-github-action@7f0a61df502599e1f1f50880aaa7ec1e2c0592f2 # v6.0.1
 
   code-quality:
     name: Code Quality
     needs: commit-lint
     runs-on: ubuntu-latest
-
     steps:
-      - uses: actions/checkout@v4
-
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - name: Setup Biome CLI
-        uses: biomejs/setup-biome@v2
-
+        uses: biomejs/setup-biome@1cbe33ead22c7a2fded3b52fa2893611c815c9b5 # v2.2.1
       - name: Run Biome
         run: biome ci
 
@@ -45,18 +39,13 @@ jobs:
           - ubuntu-latest
           - macos-latest
           - windows-latest
-
     name: "${{matrix.platform}} w/ Node.js ${{matrix.node}}.x"
     runs-on: ${{matrix.platform}}
-
     steps:
-      - uses: actions/checkout@v4
-
       - name: "Use Node.js ${{matrix.node}}.x"
-        uses: actions/setup-node@v4
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           node-version: ${{matrix.node}}.x
-
       - run: npm install
       - run: npm run build
       - run: npm test
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 985553c18..bebe71a0b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -8,14 +8,12 @@ permissions:
 jobs:
   release:
     runs-on: ubuntu-latest
-
     permissions:
       contents: write
       id-token: write
-
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
         with:
           node-version: '20'
           registry-url: 'https://registry.npmjs.org'
diff --git a/.github/workflows/update-swc.yml b/.github/workflows/update-swc.yml
index 6b8e9e21f..dcae496d5 100644
--- a/.github/workflows/update-swc.yml
+++ b/.github/workflows/update-swc.yml
@@ -17,12 +17,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           persist-credentials: false
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b # v4.0.3
 
       - name: Check if SWC update is required
         id: version-check
@@ -49,7 +49,7 @@ jobs:
 
       - name: Create Pull Request with first commit
         if: steps.version-check.outputs.UPDATE_REQUIRED == 'true'
-        uses: gr2m/create-or-update-pull-request-action@v1.9.4
+        uses: gr2m/create-or-update-pull-request-action@86ec1766034c8173518f61d2075cc2a173fb8c97 # v1.9.4
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -64,7 +64,7 @@ jobs:
 
       - name: Set up Docker
         if: steps.version-check.outputs.UPDATE_REQUIRED == 'true'
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@988b5a0280414f521da01fcc63a27aeeb4b104db # v3.6.1
 
       - name: Build WASM
         if: steps.version-check.outputs.UPDATE_REQUIRED == 'true'
@@ -72,7 +72,7 @@ jobs:
 
       - name: Create second commit
         if: steps.version-check.outputs.UPDATE_REQUIRED == 'true'
-        uses: gr2m/create-or-update-pull-request-action@v1.9.4
+        uses: gr2m/create-or-update-pull-request-action@86ec1766034c8173518f61d2075cc2a173fb8c97 # v1.9.4
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with: