diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000000..98caa0cf0d
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,28 @@
+# The contents of this file are subject to the terms of the Common Development and
+# Distribution License (the License). You may not use this file except in compliance with the
+# License.
+#
+# You can obtain a copy of the License at legal/CDDLv1.0.txt. See the License for the
+# specific language governing permission and limitations under the License.
+#
+# When distributing Covered Software, include this CDDL Header Notice in each file and include
+# the License file at legal/CDDLv1.0.txt. If applicable, add the following below the CDDL
+# Header, with the fields enclosed by brackets [] replaced by your own identifying
+# information: "Portions copyright [year] [name of copyright owner]".
+#
+# Copyright 2026 3A Systems, LLC.
+version: 2
+updates:
+  # Keeps the SHA-pinned third-party actions in .github/workflows up to date: Dependabot
+  # bumps the commit hash and the trailing "# vX.Y.Z" version comment together.
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      # One pull request per week for all action updates instead of one per action.
+      github-actions:
+        patterns: ["*"]
+    labels:
+      - "ci"
+      - "dependencies"
diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 402fb34df3..dce2f794ba 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -75,10 +75,10 @@ jobs:
       SAMPLE_FILTER: '^(?!ADMIN_CONNECT).*'
       HEAP: -Xms1g -Xmx2g
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
 
       - name: Cache JMeter
-        uses: actions/cache@v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           path: ~/jmeter
           key: jmeter-${{ env.JMETER }}
@@ -258,7 +258,7 @@ jobs:
 
       - name: Upload JMeter reports
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: jmeter-reports
           path: |
@@ -270,7 +270,7 @@ jobs:
 
       - name: Upload OpenLDAP logs
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: logs-openldap
           path: logs/openldap/
@@ -279,7 +279,7 @@ jobs:
 
       - name: Upload OpenDJ logs
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: logs-opendj
           path: logs/opendj/
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ad914f09e6..604e3ffa79 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -52,17 +52,17 @@ jobs:
       run:   |
         sudo apt-get update
         sudo apt-get install -y rpm
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       with:
         fetch-depth: 0
         submodules: recursive
     - name: Java ${{ matrix.Java }} (${{ matrix.os }})
-      uses: actions/setup-java@v5
+      uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
       with:
         java-version: ${{ matrix.java }}
         distribution: 'zulu'
     - name: Cache Maven packages
-      uses: actions/cache@v5
+      uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
       with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-m2-repository-${{ hashFiles('**/pom.xml') }}
@@ -91,7 +91,7 @@ jobs:
     # so a byte-for-byte gate would fire without a source change.
     - name: Upload Windows exe artifacts
       if: runner.os == 'Windows'
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: windows-exe-${{ matrix.java }}
         retention-days: 5
@@ -413,7 +413,7 @@ jobs:
         opendj-server-legacy\target\package\opendj\bat\windows-service.bat --disableService
 
     - name: Upload artifacts OpenDJ Server
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: ${{ matrix.os }}-${{ matrix.java }}
         retention-days: 5
@@ -440,11 +440,11 @@ jobs:
         ports:
           - 5000:5000
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           sparse-checkout: .github/benchmark
       - name: Download artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: ubuntu-latest-11
       - name: Get latest release version
@@ -528,7 +528,7 @@ jobs:
           scanners: vuln
           cache: false
       - name: Upload Trivy report to GitHub Security
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         # upload even if a preceding step failed, but not without a report to upload
         if: ${{ always() && hashFiles('trivy-results.sarif') != '' }}
         with:
@@ -536,7 +536,7 @@ jobs:
           # distinct from the docker-scan.yml categories, which track the published images
           category: trivy-build-default
       - name: Cache JMeter
-        uses: actions/cache@v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           path: ~/jmeter
           key: jmeter-5.6.3
@@ -548,7 +548,7 @@ jobs:
             "PDB" localhost:5000/${GITHUB_REPOSITORY,,}:${{ env.release_version }}
       - name: Upload benchmark artifacts (PDB vs JE)
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: benchmark-pdb-vs-je
           path: |
@@ -567,7 +567,7 @@ jobs:
             "Release" openidentityplatform/opendj:latest
       - name: Upload benchmark artifacts
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: benchmark-build-vs-release
           path: |
@@ -591,11 +591,11 @@ jobs:
         ports:
           - 5000:5000
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           sparse-checkout: .github/benchmark
       - name: Download artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: ubuntu-latest-11
       - name: Get latest release version
@@ -680,7 +680,7 @@ jobs:
           scanners: vuln
           cache: false
       - name: Upload Trivy report to GitHub Security
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         # upload even if a preceding step failed, but not without a report to upload
         if: ${{ always() && hashFiles('trivy-results.sarif') != '' }}
         with:
@@ -688,7 +688,7 @@ jobs:
           # distinct from the docker-scan.yml categories, which track the published images
           category: trivy-build-alpine
       - name: Cache JMeter
-        uses: actions/cache@v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           path: ~/jmeter
           key: jmeter-5.6.3
@@ -700,7 +700,7 @@ jobs:
             "Release-alpine" openidentityplatform/opendj:alpine
       - name: Upload benchmark artifacts
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: benchmark-build-vs-release-alpine
           path: |
@@ -716,9 +716,9 @@ jobs:
     needs: build-maven
     runs-on: 'ubuntu-latest'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - name: Download artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: ubuntu-latest-11
       - name: Clean-room install + SysV start/stop (debian:12 container)
@@ -798,9 +798,9 @@ jobs:
     needs: build-maven
     runs-on: 'ubuntu-latest'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - name: Download artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: ubuntu-latest-11
       - name: Install and start/stop in Rocky Linux 9
@@ -849,9 +849,9 @@ jobs:
     needs: build-maven
     runs-on: 'ubuntu-latest'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - name: Download artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: ubuntu-latest-11
       - name: Download released 5.1.2 deb
@@ -899,9 +899,9 @@ jobs:
     needs: build-maven
     runs-on: 'ubuntu-latest'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - name: Download artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: ubuntu-latest-11
       - name: Download released 5.1.2 rpm
@@ -1033,17 +1033,17 @@ jobs:
       # Only for .github/scripts/wait-server-stopped.ps1 and the MSI authoring the guard
       # step below reads, and it has to come first: checkout cleans the workspace the
       # artifact is unpacked into. Sparse because those two are the entire reason for it.
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           sparse-checkout: |
             .github/scripts
             opendj-packages/opendj-msi/opendj-msi-standard/resources/msi
       - name: Download artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: windows-latest-11
       - name: Set up Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           java-version: '25'
           distribution: 'zulu'
@@ -1227,11 +1227,11 @@ jobs:
       contents: read
     steps:
       - name: Download artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: windows-latest-11
       - name: Set up Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           java-version: '25'
           distribution: 'zulu'
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 3dff709730..210a692bf1 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -80,12 +80,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           submodules: recursive
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
@@ -120,13 +120,13 @@ jobs:
       # --- Java manual build (only used if the java entry is set to 'manual')
       # - name: Set up JDK 11
       #   if: matrix.language == 'java-kotlin'
-      #   uses: actions/setup-java@v5
+      #   uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
       #   with:
       #     java-version: '11'
       #     distribution: 'zulu'
       # - name: Cache Maven packages
       #   if: matrix.language == 'java-kotlin'
-      #   uses: actions/cache@v6
+      #   uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       #   with:
       #     path: ~/.m2/repository
       #     key: ${{ runner.os }}-m2-repository-${{ hashFiles('**/pom.xml') }}
@@ -139,6 +139,6 @@ jobs:
       # ---------------------------------------------------------------------
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
           category: "/language:${{ matrix.language }}"
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 4178010f7a..34cfeb18c2 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -54,7 +54,7 @@ jobs:
         run:   |
           sudo apt-get update
           sudo apt-get install -y rpm
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 0
           submodules: recursive
@@ -82,7 +82,7 @@ jobs:
       # not start new workflow runs, so this cannot loop; a PAT would break that.
       - name: Download the launchers built by the triggering Build run
         continue-on-error: true
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: windows-exe-11
           run-id: ${{ github.event.workflow_run.id }}
@@ -176,7 +176,7 @@ jobs:
           done
           echo "::warning title=Could not refresh the launcher binaries::$BRANCH kept moving under this job. Refresh opendj-server-legacy/lib/*.exe from the windows-exe-11 artifact of Build run ${RUN_ID} and commit them."
       - name: Set up Java for publishing to Maven Central Repository OSS
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           java-version: ${{ github.event.workflow_run.head_branch == 'sustaining/4.10.x' && '8' || '11'}}
           distribution: 'temurin'
@@ -184,7 +184,7 @@ jobs:
           server-username: MAVEN_USERNAME
           server-password: MAVEN_PASSWORD
       - name: Cache Maven packages
-        uses: actions/cache@v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-m2-repository-${{ hashFiles('**/pom.xml') }}
@@ -214,22 +214,22 @@ jobs:
         continue-on-error: true
         run: mvn javadoc:aggregate
       - name: Upload artifacts OpenDJ Server
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
          name: OpenDJ Server
          path: opendj-server-legacy/target/package/*.zip
       - name: Upload artifacts OpenDJ SDK Toolkit
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
          name: OpenDJ SDK Toolkit
          path: opendj-ldap-toolkit/target/*.zip
       - name: Upload artifacts OpenDJ Debian Package
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
          name: OpenDJ Debian Package
          path: opendj-packages/opendj-deb/opendj-deb-standard/target/*.deb
       - name: Upload artifacts OpenDJ RPM Package
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
          name: OpenDJ RPM Package
          path: opendj-packages/opendj-rpm/opendj-rpm-standard/target/rpm/opendj/RPMS/noarch/*.rpm
@@ -237,7 +237,7 @@ jobs:
       # Build run (windows-latest-11 artifact) instead of rebuilding it here.
       - name: Download Windows build artifact (contains the MSI)
         continue-on-error: true
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: windows-latest-11
           run-id: ${{ github.event.workflow_run.id }}
@@ -245,7 +245,7 @@ jobs:
           path: windows-build
       - name: Upload artifacts OpenDJ MSI Package
         continue-on-error: true
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
          name: OpenDJ MSI Package
          path: windows-build/opendj-packages/opendj-msi/opendj-msi-standard/target/*.msi
@@ -253,27 +253,27 @@ jobs:
          # continue-on-error) instead of warning and publishing nothing.
          if-no-files-found: error
       - name: Upload artifacts OpenDJ Docker Packages
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
          name: OpenDJ Docker Packages
          path: opendj-packages/opendj-docker/target/Dockerfile.zip
       - name: Upload artifacts OpenDJ Openshift template
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
          name: OpenDJ Openshift template
          path: opendj-packages/opendj-openshift-template/*.yaml
       - name: Upload artifacts OpenDJ Doc Generated Reference
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
          name: OpenDJ Doc Generated References
          path: opendj-doc-generated-ref/target/*.zip
       - name: Upload artifacts OpenDJ DSML Gateway
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
          name: OpenDJ DSML Gateway
          path: opendj-dsml-servlet/target/*.war
       - name: Upload artifacts OpenDJ Commons REST LDAP Gateway
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
          name: OpenDJ Commons REST LDAP Gateway
          path: opendj-rest2ldap-servlet/target/*.war
@@ -282,7 +282,7 @@ jobs:
           git config --global user.name "Open Identity Platform Community"
           git config --global user.email "open-identity-platform-opendj@googlegroups.com"
           cd ..
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         continue-on-error: true
         with:
           repository: ${{ github.repository }}.wiki
@@ -302,7 +302,7 @@ jobs:
           git commit -a -m "upload docs after deploy ${{ github.sha }}"
           git push --quiet --force
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         continue-on-error: true
         with:
           repository: OpenIdentityPlatform/doc.openidentityplatform.org
diff --git a/.github/workflows/docker-scan.yml b/.github/workflows/docker-scan.yml
index 339365855b..933aeab112 100644
--- a/.github/workflows/docker-scan.yml
+++ b/.github/workflows/docker-scan.yml
@@ -37,7 +37,7 @@ jobs:
       matrix:
         tag: [ 'latest', 'alpine' ]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
       - name: Scan openidentityplatform/opendj:${{ matrix.tag }} (Trivy)
         # unlike the build.yml gate, unfixed CVEs are reported too: surfacing them in
         # already-released images is the point of this workflow
@@ -51,7 +51,7 @@ jobs:
           scanners: vuln
           cache: false
       - name: Upload report to GitHub Security
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         # upload even if a preceding step failed, but not without a report to upload
         if: ${{ always() && hashFiles(format('trivy-{0}.sarif', matrix.tag)) != '' }}
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c5fc05b07a..06336a2382 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -50,12 +50,12 @@ jobs:
         run:   |
           sudo apt-get update
           sudo apt-get install -y rpm
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 0
           submodules: recursive
       - name: Set up Java for publishing to Maven Central Repository OSS
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           java-version: ${{ github.event.workflow_run.head_branch == 'sustaining/4.10.x' && '8' || '11'}}
           distribution: 'temurin'
@@ -63,7 +63,7 @@ jobs:
           server-username: MAVEN_USERNAME
           server-password: MAVEN_PASSWORD
       - name: Cache Maven packages
-        uses: actions/cache@v5
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-m2-repository-${{ hashFiles('**/pom.xml') }}
@@ -93,7 +93,7 @@ jobs:
       # built on Windows), so it does not have to rebuild opendj-server-legacy.
       - name: Upload the server zip for the MSI job
         continue-on-error: true
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: release-server-zip
           retention-days: 1
@@ -120,7 +120,7 @@ jobs:
             target/checkout/opendj-doc-generated-ref/target/*.zip
             target/checkout/opendj-dsml-servlet/target/*.war
             target/checkout/opendj-rest2ldap-servlet/target/*.war
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         continue-on-error: true
         with:
           repository: ${{ github.repository }}.wiki
@@ -143,7 +143,7 @@ jobs:
            git push --quiet --force
            git push --quiet --force origin ${{ github.event.inputs.releaseVersion }}
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         continue-on-error: true
         with:
           repository: OpenIdentityPlatform/doc.openidentityplatform.org
@@ -174,12 +174,12 @@ jobs:
     needs:
       - release-maven
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           ref: ${{ github.event.inputs.releaseVersion }}
           submodules: recursive
       - name: Set up Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           java-version: '11'
           distribution: 'temurin'
@@ -188,7 +188,7 @@ jobs:
       # and saving that under the key build-maven restores from would seed every later
       # Windows build with it.
       - name: Cache Maven packages
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
          path: ~/.m2/repository
          key: ${{ runner.os }}-m2-repository-${{ hashFiles('**/pom.xml') }}
@@ -204,7 +204,7 @@ jobs:
           wix --version
           wix extension add -g WixToolset.UI.wixext/5.0.2 || true
       - name: Download the server zip built by release-maven
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: release-server-zip
           path: server-zip
@@ -246,7 +246,7 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           ref: ${{ github.event.inputs.releaseVersion }}
           fetch-depth: 1
@@ -298,7 +298,7 @@ jobs:
       contents: read
       packages: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           ref: ${{ github.event.inputs.releaseVersion }}
           fetch-depth: 1