diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 5f0105e..fdc5dd8 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -15,10 +15,10 @@ jobs:
       matrix:
         python: ['3.11', '3.13']
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
           python-version: ${{ matrix.python }}
       - run: python -m pip install -r requirements.txt
diff --git a/.github/workflows/phase1-warn.yml b/.github/workflows/phase1-warn.yml
index 71ba5f0..e392429 100644
--- a/.github/workflows/phase1-warn.yml
+++ b/.github/workflows/phase1-warn.yml
@@ -29,17 +29,17 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
           path: target
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           repository: 4444J99/github-engineering-standards
           ref: ${{ inputs.standards-ref }}
           persist-credentials: false
           path: ges
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
           python-version: '3.13'
       - name: Install pinned tools (checksum-verified)
@@ -92,7 +92,7 @@ jobs:
       contents: read
       actions: read
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           repository: 4444J99/github-engineering-standards
           ref: ${{ inputs.standards-ref }}
diff --git a/.github/workflows/source-acquisition.yml b/.github/workflows/source-acquisition.yml
index a5f65c9..7d09cc6 100644
--- a/.github/workflows/source-acquisition.yml
+++ b/.github/workflows/source-acquisition.yml
@@ -46,10 +46,10 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 30
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: false
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
           python-version: '3.13'
       - run: python -m pip install -r requirements.txt
@@ -115,7 +115,7 @@ jobs:
                   if path.exists():
                       archive.add(path, arcname=name)
           PY
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         if: always()
         with:
           name: standards-metadata-evidence
diff --git a/.github/workflows/warning-pilot.yml b/.github/workflows/warning-pilot.yml
index 12cf5af..95857f0 100644
--- a/.github/workflows/warning-pilot.yml
+++ b/.github/workflows/warning-pilot.yml
@@ -41,7 +41,7 @@ jobs:
           subprocess.run(['git', '-C', path, 'update-ref', 'HEAD', revision], check=True, capture_output=True, timeout=15)
           PY
       - name: Read immutable inspector
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           repository: 4444J99/github-engineering-standards
           ref: a5cdf48e9f255cb407a1ae69be62397f1151847d
@@ -49,7 +49,7 @@ jobs:
           persist-credentials: false
           submodules: false
           lfs: false
-      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
         with:
           python-version: '3.12'
       - name: Install inspector dependency
@@ -215,7 +215,7 @@ jobs:
                   summary.write(f"- {finding['control']}: {finding['status']}\n")
           PY
       - name: Retain report and integrity manifest in caller custody
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
         with:
           name: warning-pilot-${{ github.run_id }}-${{ github.run_attempt }}
           path: |