diff --git a/.github/workflows/assets-rehearsal-nightly.yml b/.github/workflows/assets-rehearsal-nightly.yml
index 76740a1b3f..c9f6400fb0 100644
--- a/.github/workflows/assets-rehearsal-nightly.yml
+++ b/.github/workflows/assets-rehearsal-nightly.yml
@@ -122,7 +122,7 @@ jobs:
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
           echo "Building pv for $TAG -> ${{ matrix.target }} on ${{ matrix.host }}"
       - name: Checkout at tag
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           ref: ${{ github.sha }}
       - name: Stamp the rc version into the tag tree (#4110)
@@ -277,7 +277,7 @@ jobs:
           fi
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
       - name: Checkout at tag
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           ref: ${{ github.sha }}
       - name: Stamp the rc version into the tag tree (#4110)
@@ -440,7 +440,7 @@ jobs:
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
           echo "Building apr --features cuda for $TAG → ${{ matrix.target }}"
       - name: Checkout at tag
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           ref: ${{ github.sha }}
       - name: Stamp the rc version into the tag tree (#4110)
@@ -592,7 +592,7 @@ jobs:
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
           echo "Building apr (default features, no cuda) for $TAG -> ${{ matrix.target }}"
       - name: Checkout at tag
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           ref: ${{ github.sha }}
       - name: Stamp the rc version into the tag tree (#4110)
@@ -745,7 +745,7 @@ jobs:
           [ -n "$TAG" ] || { echo "::error::No tag resolved"; exit 1; }
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
       - name: Checkout at tag
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           ref: ${{ github.sha }}
       - name: Stamp the rc version into the tag tree (#4110)
diff --git a/.github/workflows/beat-speed-nightly.yml b/.github/workflows/beat-speed-nightly.yml
index eb80311551..916e356039 100644
--- a/.github/workflows/beat-speed-nightly.yml
+++ b/.github/workflows/beat-speed-nightly.yml
@@ -78,7 +78,7 @@ jobs:
       # fix for it (#2326). `github` IS a valid context at job level.
       BEAT_LOG: ${{ github.workspace }}/beat-speed-measurements.log
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       # PERF-031 measurement-environment receipt.
       #
diff --git a/.github/workflows/binary-release.yml b/.github/workflows/binary-release.yml
index 438efddb3e..866e30a925 100644
--- a/.github/workflows/binary-release.yml
+++ b/.github/workflows/binary-release.yml
@@ -98,7 +98,7 @@ jobs:
     outputs:
       present: ${{ steps.check.outputs.present }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
       - id: check
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -158,7 +158,7 @@ jobs:
           echo "Building pv for $TAG -> ${{ matrix.target }} on ${{ matrix.host }}"
 
       - name: Checkout at tag
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           ref: ${{ steps.tag.outputs.tag }}
 
@@ -325,7 +325,7 @@ jobs:
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
 
       - name: Checkout at tag
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           ref: ${{ steps.tag.outputs.tag }}
 
@@ -486,7 +486,7 @@ jobs:
           echo "Building apr --features cuda for $TAG → ${{ matrix.target }}"
 
       - name: Checkout at tag
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           ref: ${{ steps.tag.outputs.tag }}
 
@@ -657,7 +657,7 @@ jobs:
           echo "Building apr (default features, no cuda) for $TAG -> ${{ matrix.target }}"
 
       - name: Checkout at tag
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           ref: ${{ steps.tag.outputs.tag }}
 
@@ -827,7 +827,7 @@ jobs:
           echo "tag=$TAG" >> "$GITHUB_OUTPUT"
 
       - name: Checkout at tag
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           ref: ${{ steps.tag.outputs.tag }}
 
@@ -920,7 +920,7 @@ jobs:
       # This job had no checkout: it curled the API and parsed with python3. The
       # preflight needs the tree, and so does the checker — and the tree is one
       # second on the clean-room pool.
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Preflight - this box has the tools this job assumes
         run: bash scripts/ci_self_hosted_preflight.sh
@@ -960,7 +960,7 @@ jobs:
             labels: '["self-hosted", "Linux", "ARM64", "cuda", "gx10", "ephemeral", "docker"]'
     runs-on: ${{ fromJSON(matrix.labels) }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       # The smoke step below needs curl, python3, sha256sum, tar and a visible
       # device. Each of those is a separate way for this job to fail late and
@@ -1044,7 +1044,7 @@ jobs:
             preflight: '--need docker objdump'
     runs-on: ${{ fromJSON(matrix.labels) }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       # No `--cuda` on any row, including the GPU ones: this job proves a CPU
       # asset, and a device assertion here would make a green depend on hardware
@@ -1105,7 +1105,7 @@ jobs:
     runs-on: [self-hosted, Linux, X64, clean-room]
     if: always()
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Preflight — this box has the tools this job assumes
         run: bash scripts/ci_self_hosted_preflight.sh
diff --git a/.github/workflows/book-contracts.yml b/.github/workflows/book-contracts.yml
index b28d4404fe..3798255f3a 100644
--- a/.github/workflows/book-contracts.yml
+++ b/.github/workflows/book-contracts.yml
@@ -61,8 +61,8 @@ jobs:
     name: Chapter Examples Compile
     runs-on: [self-hosted, Linux, X64, clean-room]
     steps:
-      - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec  # stable
       # NO rust-cache: cache-bin false was never the fix.
       #
       # It skips cleanBin and NOTHING else. rust-cache's save step also runs
@@ -105,8 +105,8 @@ jobs:
     runs-on: [self-hosted, Linux, X64, clean-room]
     needs: chapter-examples-compile
     steps:
-      - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec  # stable
       # NO rust-cache: cache-bin false was never the fix.
       #
       # It skips cleanBin and NOTHING else. rust-cache's save step also runs
@@ -156,8 +156,8 @@ jobs:
     name: Book Integration Tests
     runs-on: [self-hosted, Linux, X64, clean-room]
     steps:
-      - uses: actions/checkout@v7
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec  # stable
       # NO rust-cache: cache-bin false was never the fix.
       #
       # It skips cleanBin and NOTHING else. rust-cache's save step also runs
@@ -188,7 +188,7 @@ jobs:
     name: Contract Enforcement
     runs-on: [self-hosted, Linux, X64, clean-room]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
       - name: Every chapter has a contract
         run: |
           FAIL=0
@@ -248,7 +248,7 @@ jobs:
     name: Namespace Discipline
     runs-on: [self-hosted, Linux, X64, clean-room]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
       - name: No legacy imports in chapter examples
         run: |
           FAIL=0
@@ -289,7 +289,7 @@ jobs:
     name: SUMMARY.md Integrity
     runs-on: [self-hosted, Linux, X64, clean-room]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
       - name: No dead links in SUMMARY.md
         run: |
           FAIL=0
diff --git a/.github/workflows/book.yml b/.github/workflows/book.yml
index f695c6ed4e..1f58cbbc2a 100644
--- a/.github/workflows/book.yml
+++ b/.github/workflows/book.yml
@@ -74,7 +74,7 @@ jobs:
     name: Build Book
     runs-on: [self-hosted, Linux, X64, clean-room]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       # Self-hosted (#3073): tools go into this run's private $RUNNER_TEMP, never a $HOME path that every
       # runner on the box execs from (the aprender#2353 race; check_cargo_install_private_root.sh enforces
@@ -199,7 +199,7 @@ jobs:
           fi
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9  # v5
         with:
           path: ./book/book
 
@@ -221,4 +221,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@368f82528645a54fb793d4d04e342629a3f51346  # v5
diff --git a/.github/workflows/ci-unwedge.yml b/.github/workflows/ci-unwedge.yml
index 063b041df0..c7d56b9149 100644
--- a/.github/workflows/ci-unwedge.yml
+++ b/.github/workflows/ci-unwedge.yml
@@ -62,7 +62,7 @@ jobs:
     runs-on: ${{ github.event.schedule == '*/10 0-5,20-23 * * *' && fromJSON('["self-hosted", "X64", "Linux", "clean-room"]') || fromJSON('["self-hosted", "Linux", "clean-room", "ARM64"]') }}
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       # The instrument proves itself before it is allowed to cancel anything.
       # Fifteen rows over committed fixtures, no network: three wedged shapes,
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d0f3850566..1b626f9820 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -113,7 +113,7 @@ jobs:
     steps:
       # Full history: the key reads the queue head's parent, the base's parent and
       # whether the base is an ancestor of the PR head.
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 0
       - name: The reuse key's case table (hermetic)
@@ -145,7 +145,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
       - name: The reuse key's case table (hermetic)
         run: bash scripts/ci_mg_reuse.sh --self-test
       - name: The fat wait is cancel-aware and the teardown still runs on cancel
@@ -202,7 +202,7 @@ jobs:
           [ "$(jq --version)" = "jq-1.8.2" ] || { echo "::error::jq on PATH reports $(jq --version)"; exit 1; }
       # Full history: a section whose own checkout asked for depth 1 (the default)
       # is cut back to exactly that by the driver; one asking for 0 needs it all.
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 0
       # Fail fast: the reds car#4429 took four fat runs to see, in ~2 min, before
@@ -253,7 +253,7 @@ jobs:
           --results "$RUNNER_TEMP/fat/results.json"
           --background-until 'determinism[X64]'
       # Published mid-run: the determinism job's compare section is waiting for it.
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         with:
           name: determinism-X64
           path: ${{ runner.temp }}/fat/artifacts/determinism-X64/
@@ -272,14 +272,14 @@ jobs:
       - name: Remove this job's section containers (runs on cancel too)
         if: always()
         run: if [ -f scripts/ci/fat_teardown.sh ]; then bash scripts/ci/fat_teardown.sh "$GITHUB_RUN_ID" "$RUNNER_TEMP"; fi
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         if: always()
         with:
           name: pr-review-shadow-sample
           path: ${{ runner.temp }}/fat/artifacts/pr-review-shadow-sample/
           retention-days: 90
           if-no-files-found: ignore
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         if: always()
         with:
           name: bench-${{ github.event.repository.name }}
@@ -319,7 +319,7 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
       - name: Install cargo-deny (if absent)
         env:
           CARGO_INSTALL_ROOT: ${{ runner.temp }}/cargo-deny
@@ -380,7 +380,7 @@ jobs:
       FAT_EXPECT_ARTIFACTS: determinism-X64,determinism-ARM64
       FAT_ARTIFACT_WAIT_S: "0"
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 0
       - name: Sections (the ARM64 raster returns first; the compare keeps running)
@@ -389,7 +389,7 @@ jobs:
           --sections 'determinism[ARM64],determinism-compare'
           --results "$RUNNER_TEMP/fat/results.json"
           --background-until 'determinism[ARM64]'
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         with:
           name: determinism-ARM64
           path: ${{ runner.temp }}/fat/artifacts/determinism-ARM64/
@@ -407,13 +407,13 @@ jobs:
       - name: Remove this job's section containers (runs on cancel too)
         if: always()
         run: if [ -f scripts/ci/fat_teardown.sh ]; then bash scripts/ci/fat_teardown.sh "$GITHUB_RUN_ID" "$RUNNER_TEMP"; fi
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         if: always()
         with:
           name: determinism-receipt
           path: ${{ runner.temp }}/fat/artifacts/determinism-receipt/
           if-no-files-found: ignore
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         if: always()
         with:
           name: raster-receipt
@@ -453,7 +453,7 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       FAT_VARS_JSON: ${{ toJSON(vars) }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 0
       # #4596: see the x86-main step of the same name.
@@ -474,7 +474,7 @@ jobs:
       - name: Remove this job's section containers (runs on cancel too)
         if: always()
         run: if [ -f scripts/ci/fat_teardown.sh ]; then bash scripts/ci/fat_teardown.sh "$GITHUB_RUN_ID" "$RUNNER_TEMP"; fi
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         if: always()
         with:
           name: sigma-shard-${{ matrix.shard }}
@@ -500,8 +500,8 @@ jobs:
           set -euo pipefail
           echo "workspace-test-shard matrix result: $SHARD_RESULT"
           [ "$SHARD_RESULT" = success ] || { echo "::error::workspace-test: shard matrix result is '$SHARD_RESULT' (a cancelled or skipped shard is not a pass)"; exit 1; }
-      - uses: actions/checkout@v7
-      - uses: actions/download-artifact@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
+      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
         with:
           pattern: sigma-shard-*
           path: ${{ runner.temp }}/sigma
diff --git a/.github/workflows/conleche-nightly.yml b/.github/workflows/conleche-nightly.yml
index 767e167d96..b2a1ede0c6 100644
--- a/.github/workflows/conleche-nightly.yml
+++ b/.github/workflows/conleche-nightly.yml
@@ -46,7 +46,7 @@ jobs:
       ELAN_SHA256: 42b94d4244e8353142c456ec0e4ca6528fd898a6c604d4059f494e706e431f63
       LEAN_NUM_THREADS: '8'
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 1
       - name: Verdict case table (the classifier this job trusts)
diff --git a/.github/workflows/coverage-nightly.yml b/.github/workflows/coverage-nightly.yml
index c5745712b6..836a6e06d3 100644
--- a/.github/workflows/coverage-nightly.yml
+++ b/.github/workflows/coverage-nightly.yml
@@ -106,7 +106,7 @@ jobs:
       # pristine tree, and the default git-clean choked on root-owned leftovers
       # (e.g. contracts/.pv/cache from prior `pv` jobs → EACCES on rmdir),
       # failing checkout before any coverage ran.
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           clean: false
 
@@ -241,7 +241,7 @@ jobs:
       - name: Upload coverage JSON
         if: always() && hashFiles('target/coverage/coverage.json') != ''
         continue-on-error: true
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         with:
           name: coverage-json
           path: |
@@ -266,7 +266,7 @@ jobs:
       - name: Publish the coverage receipt
         if: always()
         continue-on-error: true
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         with:
           name: coverage-receipt
           path: ${{ runner.temp }}/cov-receipt/coverage-receipt-*.json
diff --git a/.github/workflows/cuda-nightly.yml b/.github/workflows/cuda-nightly.yml
index adb5738a6c..dc6750ba99 100644
--- a/.github/workflows/cuda-nightly.yml
+++ b/.github/workflows/cuda-nightly.yml
@@ -171,7 +171,7 @@ jobs:
           fi
           echo "proceed=true" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         if: steps.decide.outputs.proceed == 'true'
 
       # The first thing gx10 does once it has a tree. NOT before `decide` and
@@ -609,7 +609,7 @@ jobs:
       # only visible if that marker leaves the runner.
       - name: PP-26 - upload the witness
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         with:
           name: pp26-witness-${{ matrix.name }}
           path: |
diff --git a/.github/workflows/deep-nightly.yml b/.github/workflows/deep-nightly.yml
index 2fd5960a47..e3980b5070 100644
--- a/.github/workflows/deep-nightly.yml
+++ b/.github/workflows/deep-nightly.yml
@@ -56,7 +56,7 @@ jobs:
     runs-on: [self-hosted, Linux, X64, clean-room]
     timeout-minutes: 240
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           ref: ${{ inputs.ref || github.sha }}
       - name: Assert HEAD is ${{ inputs.ref || github.sha }}
@@ -76,7 +76,7 @@ jobs:
 
       - name: Publish the log
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         with:
           name: deep-doctests-log
           path: deep/deep-doctests.log
@@ -86,7 +86,7 @@ jobs:
     runs-on: [self-hosted, Linux, X64, clean-room]
     timeout-minutes: 120
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           ref: ${{ inputs.ref || github.sha }}
       # The verdict proves itself before it judges: its case table, then its mutants. They
@@ -115,7 +115,7 @@ jobs:
 
       - name: Publish the log
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         with:
           name: deep-nodefault-log
           path: deep/deep-nodefault.log
@@ -125,7 +125,7 @@ jobs:
     runs-on: [self-hosted, Linux, X64, clean-room]
     timeout-minutes: 240
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           ref: ${{ inputs.ref || github.sha }}
       - name: Assert HEAD is ${{ inputs.ref || github.sha }}
@@ -162,7 +162,7 @@ jobs:
 
       - name: Publish the smoke table
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         with:
           name: deep-bins-smoke
           path: deep/
diff --git a/.github/workflows/deploy-apr-install.yml b/.github/workflows/deploy-apr-install.yml
index caa384f2a3..88a624acb1 100644
--- a/.github/workflows/deploy-apr-install.yml
+++ b/.github/workflows/deploy-apr-install.yml
@@ -54,7 +54,7 @@ jobs:
           echo "ref=${REF:-$GITHUB_SHA}" >> "$GITHUB_OUTPUT"
           echo "Publishing scripts/install.sh from ${REF:-$GITHUB_SHA}"
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           ref: ${{ steps.ref.outputs.ref }}
 
@@ -67,7 +67,7 @@ jobs:
         run: bashrs lint --level error scripts/install.sh
 
       - name: Configure AWS credentials (OIDC, apr-install-deploy role)
-        uses: aws-actions/configure-aws-credentials@v4
+        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a  # v4
         with:
           role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_ARN }}
           aws-region: us-east-1
diff --git a/.github/workflows/dogfood-nightly.yml b/.github/workflows/dogfood-nightly.yml
index 0ba1a1dbab..ae326a97f1 100644
--- a/.github/workflows/dogfood-nightly.yml
+++ b/.github/workflows/dogfood-nightly.yml
@@ -57,7 +57,7 @@ jobs:
     outputs:
       sha: ${{ steps.pick.outputs.sha }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           sparse-checkout: |
             scripts/release/dogfood_night_sha.sh
@@ -97,7 +97,7 @@ jobs:
     env:
       PLANT: ${{ github.event.inputs.plant || 'none' }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           ref: ${{ needs.night.outputs.sha }}
           fetch-depth: 0
@@ -171,7 +171,7 @@ jobs:
 
       - name: Publish tonight's receipt and the logs
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         with:
           name: dogfood-receipt
           path: |
diff --git a/.github/workflows/edge-fast-verbs-nightly.yml b/.github/workflows/edge-fast-verbs-nightly.yml
index 9982ce23c2..ada16819ef 100644
--- a/.github/workflows/edge-fast-verbs-nightly.yml
+++ b/.github/workflows/edge-fast-verbs-nightly.yml
@@ -56,7 +56,7 @@ jobs:
           rc=0; "$d/jq" -e . < /dev/null > /dev/null || rc=$?
           [ "$rc" = 4 ] || { echo "::error::the pinned jq exits $rc on empty input with -e, not 4"; exit 1; }
           echo "$d" >> "$GITHUB_PATH"
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
       - name: Build apr (cuda)
         run: |
           export PATH="$HOME/.cargo/bin:/usr/local/cuda/bin:$PATH"
diff --git a/.github/workflows/examples-nightly.yml b/.github/workflows/examples-nightly.yml
index 79d82e2697..3191b8da87 100644
--- a/.github/workflows/examples-nightly.yml
+++ b/.github/workflows/examples-nightly.yml
@@ -50,7 +50,7 @@ jobs:
     runs-on: [self-hosted, Linux, X64, clean-room, yoga]
     timeout-minutes: 300
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           ref: ${{ inputs.ref || github.sha }}
       - name: Assert HEAD is ${{ inputs.ref || github.sha }}
@@ -72,7 +72,7 @@ jobs:
 
       - name: Publish the examples ledger
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         with:
           name: examples-ledger
           path: evidence/dogfood/*/examples.tsv
diff --git a/.github/workflows/fleet-toolset.yml b/.github/workflows/fleet-toolset.yml
index a8f02d4ac4..6244341533 100644
--- a/.github/workflows/fleet-toolset.yml
+++ b/.github/workflows/fleet-toolset.yml
@@ -77,7 +77,7 @@ jobs:
             cuda: true
             labels: '["self-hosted", "Linux", "X64", "cuda", "yoga", "ephemeral", "docker"]'
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Preflight — this box has the tools this job assumes
         env:
@@ -94,7 +94,7 @@ jobs:
       # the days worth recording.
       - name: Upload this box's toolset record
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         with:
           name: toolset-${{ matrix.name }}
           path: ${{ runner.temp }}/preflight.json
@@ -108,13 +108,13 @@ jobs:
     runs-on: [self-hosted, Linux, X64, clean-room]
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Preflight — this box has the tools this job assumes
         run: bash scripts/ci_self_hosted_preflight.sh
 
       - name: Download every box's record
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
         with:
           pattern: toolset-*
           path: fleet
@@ -173,7 +173,7 @@ jobs:
 
       - name: Upload the merged fleet record
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         with:
           name: fleet-toolset
           path: fleet
diff --git a/.github/workflows/gpu-lab-nightly.yml b/.github/workflows/gpu-lab-nightly.yml
index 1511e678ea..dd9a8b0ebf 100644
--- a/.github/workflows/gpu-lab-nightly.yml
+++ b/.github/workflows/gpu-lab-nightly.yml
@@ -30,7 +30,7 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       FAT_VARS_JSON: ${{ toJSON(vars) }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 0
       - name: Sections
@@ -57,7 +57,7 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       FAT_VARS_JSON: ${{ toJSON(vars) }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 0
       - name: Sections
diff --git a/.github/workflows/guards-nightly.yml b/.github/workflows/guards-nightly.yml
index af5fe6b1d5..f0869ccba9 100644
--- a/.github/workflows/guards-nightly.yml
+++ b/.github/workflows/guards-nightly.yml
@@ -106,7 +106,7 @@ jobs:
           else
             echo "Image not cached — no prior docker job on this runner, nothing to restore"
           fi
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 1
       # THE MANIFEST IS THE JOIN KEY, AND IT IS CHECKED BEFORE ANYTHING RUNS.
diff --git a/.github/workflows/install-script.yml b/.github/workflows/install-script.yml
index f8daec95c5..43e1d1535e 100644
--- a/.github/workflows/install-script.yml
+++ b/.github/workflows/install-script.yml
@@ -51,7 +51,7 @@ jobs:
     name: install_test.sh
     runs-on: [self-hosted, Linux, X64, clean-room]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       # pmat/bashrs are pinned-fleet tools, never installed per-job (BSE-10a,
       # PMAT-1066) — see ci.yml's identical step for why.
diff --git a/.github/workflows/mini-probe.yml b/.github/workflows/mini-probe.yml
index ef73a234e9..e20a1fbf46 100644
--- a/.github/workflows/mini-probe.yml
+++ b/.github/workflows/mini-probe.yml
@@ -143,7 +143,7 @@ jobs:
     steps:
       - name: Checkout the tree under test
         if: matrix.job != 'workspace-test' || inputs.include_workspace_test == 'true'
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           ref: ${{ inputs.ref }}
 
@@ -459,7 +459,7 @@ jobs:
 
       - name: Row + per-step detail leave the runner (always)
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         with:
           name: mini-probe-${{ matrix.job }}
           path: ${{ runner.temp }}/probe/
@@ -480,7 +480,7 @@ jobs:
     timeout-minutes: 22
     steps:
       - name: Collect the probe rows
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
         with:
           pattern: mini-probe-*
           merge-multiple: true
@@ -530,7 +530,7 @@ jobs:
 
       - name: Row leaves the runner (always)
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         with:
           name: mini-probe-gate
           path: ${{ runner.temp }}/probe/
@@ -548,10 +548,10 @@ jobs:
       # The DISPATCHING branch, not inputs.ref: scripts/mini_probe_summary.sh is
       # new in this pull request and does not exist at the reference sha.
       - name: Checkout the dispatching branch (for the renderer)
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Collect every row
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
         with:
           pattern: mini-probe-*
           merge-multiple: true
@@ -571,7 +571,7 @@ jobs:
 
       - name: Upload the measured neutral list
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         with:
           name: mini-probe-summary
           path: |
diff --git a/.github/workflows/models-nightly.yml b/.github/workflows/models-nightly.yml
index 1468290151..4cd26be4e9 100644
--- a/.github/workflows/models-nightly.yml
+++ b/.github/workflows/models-nightly.yml
@@ -114,7 +114,7 @@ jobs:
           else
             echo "Image not cached — no prior docker job on this runner, nothing to restore"
           fi
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 1
       - name: The producer's case table, before it is trusted
@@ -133,7 +133,7 @@ jobs:
         # plant: a not_measured bundle proved nothing, and a planted red is not
         # a measurement.
         if: steps.relay.outputs.bundle != ''
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         with:
           name: models-crux
           path: ${{ steps.relay.outputs.bundle }}
@@ -185,7 +185,7 @@ jobs:
           else
             echo "Image not cached — no prior docker job on this runner, nothing to restore"
           fi
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 1
       - name: Relay the GPU-host ladder of this commit
@@ -196,7 +196,7 @@ jobs:
         # its head and globs *.json at the artifact root, so the upload is the
         # bundle dir itself.
         if: steps.ladder.outputs.bundle != ''
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         with:
           name: models-t1
           path: ${{ steps.ladder.outputs.bundle }}
diff --git a/.github/workflows/mutants-nightly.yml b/.github/workflows/mutants-nightly.yml
index 6da1f6d287..b7c9156ba9 100644
--- a/.github/workflows/mutants-nightly.yml
+++ b/.github/workflows/mutants-nightly.yml
@@ -40,7 +40,7 @@ jobs:
           else
             echo "Image not cached — no prior docker job on this runner, nothing to restore"
           fi
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 0
       - name: Everything merged since the last nightly that JUDGED main, as a diff
@@ -119,7 +119,7 @@ jobs:
             '
       - name: Upload mutation results
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         with:
           name: mutants-nightly
           path: mutants-gate/
@@ -138,7 +138,7 @@ jobs:
       contents: read
       actions: write # PUT .../workflows/mutants-nightly.yml/disable
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           sparse-checkout: scripts
       - name: Red or unmeasured with last week's run also not green disables this workflow
diff --git a/.github/workflows/nightly-bench.yml b/.github/workflows/nightly-bench.yml
index 71b75c67a2..6bd4957fa5 100644
--- a/.github/workflows/nightly-bench.yml
+++ b/.github/workflows/nightly-bench.yml
@@ -63,7 +63,7 @@ jobs:
     runs-on: [self-hosted, X64, Linux, clean-room, intel]   # perf: the SAME box as the recorded baselines — clean-room now spans intel + yoga + gx10 (#3100)
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       # The receipt validator's own case table must discriminate before any
       # number it blesses means anything.
diff --git a/.github/workflows/nightly-train.yml b/.github/workflows/nightly-train.yml
index cd63822b01..a7e380ea3f 100644
--- a/.github/workflows/nightly-train.yml
+++ b/.github/workflows/nightly-train.yml
@@ -50,7 +50,7 @@ jobs:
         run: |
           { cat "$RUNNER_TEMP/line" 2>/dev/null || echo "no line printed"
             echo; echo '```'; cat "$RUNNER_TEMP"/nt/*/reds.tsv 2>/dev/null | head -n 40; echo '```'; } >> "$GITHUB_STEP_SUMMARY"
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         if: always()
         with:
           name: nightly-train
@@ -71,7 +71,7 @@ jobs:
       issues: write
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      - uses: actions/download-artifact@v7   # same major as the upload-artifact@v7 above
+      - uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131   # v7, same major as the upload-artifact@v7 above
         continue-on-error: true   # a missing artifact is the andon's "no verdict line" case, never a skip
         with:
           name: nightly-train
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index 6843812910..58002b79aa 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -77,7 +77,7 @@ jobs:
       # 2026-09-28). gate resolves main's head ONCE; build and publish check out that
       # exact sha, so a push to main mid-run cannot split one nightly across two heads.
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           ref: main
 
@@ -127,7 +127,7 @@ jobs:
       NIGHTLY_SHA: ${{ needs.gate.outputs.sha }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           ref: ${{ needs.gate.outputs.sha }}
 
@@ -236,7 +236,7 @@ jobs:
 
       - name: Upload artifact
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         with:
           name: nightly-${{ matrix.target }}
           path: dist/*
@@ -265,7 +265,7 @@ jobs:
       T: aarch64-apple-darwin
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
 
       - name: Build apr (host-native, pinned toolchain)
         run: |
@@ -294,7 +294,7 @@ jobs:
           echo "Packaged: ${ARCHIVE}.tar.gz ($(du -h "${ARCHIVE}.tar.gz" | cut -f1))"
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         with:
           name: apr-aarch64-apple-darwin
           path: |
@@ -320,7 +320,7 @@ jobs:
       CARGO_INCREMENTAL: 0
       CARGO_TERM_COLOR: never
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           ref: ${{ needs.gate.outputs.sha }}
       - name: Toolchain is the pinned one
@@ -342,7 +342,7 @@ jobs:
       NIGHTLY_SHA: ${{ needs.gate.outputs.sha }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           ref: ${{ needs.gate.outputs.sha }}
 
@@ -351,7 +351,7 @@ jobs:
       - name: Download build artifacts
         if: needs.gate.outputs.decision == 'build'
         continue-on-error: true
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
         with:
           path: dist
           merge-multiple: true
@@ -402,13 +402,13 @@ jobs:
     runs-on: [self-hosted, Linux, X64, clean-room]
     steps:
       - name: Download darwin artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093  # v4
         with:
           name: apr-aarch64-apple-darwin
           path: dist-darwin
 
       - name: Upload to the nightly release
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64  # v3
         with:
           tag_name: nightly
           name: Nightly Build
diff --git a/.github/workflows/pr-review-quorum.yml b/.github/workflows/pr-review-quorum.yml
index 18116bfb67..e9c297cbac 100644
--- a/.github/workflows/pr-review-quorum.yml
+++ b/.github/workflows/pr-review-quorum.yml
@@ -100,7 +100,7 @@ jobs:
       LAB_TICKET_TITLE: 'LAB: pr-review-quorum present - nightly receipt check of merged PRs'
     steps:
       - name: Checkout main
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           # Arm 4 diffs each squash against its parent and resolves ancestry with
           # `git merge-base`, which a shallow clone cannot answer.
diff --git a/.github/workflows/provable-ladder-nightly.yml b/.github/workflows/provable-ladder-nightly.yml
index 0343876001..d08fb38950 100644
--- a/.github/workflows/provable-ladder-nightly.yml
+++ b/.github/workflows/provable-ladder-nightly.yml
@@ -61,7 +61,7 @@ jobs:
           v=$("$d/jq" --version)
           [ "$v" = "jq-1.8.2" ] || { echo "::error::the pinned jq reports '$v', not jq-1.8.2"; exit 1; }
           echo "$d" >> "$GITHUB_PATH"
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           fetch-depth: 0
       - name: The event split's case table (stubs, seconds)
diff --git a/.github/workflows/qwen-story-daily.yml b/.github/workflows/qwen-story-daily.yml
index 43ac938667..ff7fe0a914 100644
--- a/.github/workflows/qwen-story-daily.yml
+++ b/.github/workflows/qwen-story-daily.yml
@@ -75,7 +75,7 @@ jobs:
       PMAT_HUNT: ${{ github.event.inputs.pmat_hunt || '1' }}
       RUST_BACKTRACE: '1'
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           # On workflow_run, GITHUB_SHA is main's tip, not the commit coverage
           # measured. Check out the measured commit, so the hunt's sha check
@@ -223,7 +223,7 @@ jobs:
 
       - name: Upload pmat manifest artifact
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         with:
           name: pmat-manifest
           path: /tmp/qwen-story-artifacts/pmat-manifest.txt
@@ -231,7 +231,7 @@ jobs:
 
       - name: Upload story log artifact
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         with:
           name: story-log
           path: /tmp/story.log
diff --git a/.github/workflows/rc-cut.yml b/.github/workflows/rc-cut.yml
index ea86e867c4..32cbddb2e4 100644
--- a/.github/workflows/rc-cut.yml
+++ b/.github/workflows/rc-cut.yml
@@ -57,7 +57,7 @@ jobs:
     # Cheap pre-filter only; rc_cut.sh re-judges every condition itself.
     if: github.event.workflow_run.conclusion != 'cancelled'
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           # the default branch's script, never the release branch's
           ref: ${{ github.event.repository.default_branch }}
diff --git a/.github/workflows/readiness-nightly.yml b/.github/workflows/readiness-nightly.yml
index dd0d6636d4..de6709070e 100644
--- a/.github/workflows/readiness-nightly.yml
+++ b/.github/workflows/readiness-nightly.yml
@@ -83,7 +83,7 @@ jobs:
       MC: ${{ needs.inputs.outputs.sha }}
       CARGO_TARGET_DIR: ${{ github.workspace }}/target   # warm across nights (clean: false); the build and TD read the same dir
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           ref: ${{ needs.inputs.outputs.sha }}
           fetch-depth: 0
@@ -134,7 +134,7 @@ jobs:
 
       - name: Publish the readiness log and graph
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         with:
           name: readiness-t1
           path: |
diff --git a/.github/workflows/release-gates-nightly.yml b/.github/workflows/release-gates-nightly.yml
index a1abc4e6f4..49e4570535 100644
--- a/.github/workflows/release-gates-nightly.yml
+++ b/.github/workflows/release-gates-nightly.yml
@@ -59,7 +59,7 @@ jobs:
     runs-on: [self-hosted, X64, Linux, clean-room, intel]
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           ref: ${{ inputs.ref || github.sha }}
           fetch-depth: 0   # the tags name the last release
@@ -97,7 +97,7 @@ jobs:
     runs-on: [self-hosted, X64, Linux, clean-room, intel]
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           ref: ${{ inputs.ref || github.sha }}
       - name: Assert HEAD is ${{ inputs.ref || github.sha }}
@@ -116,7 +116,7 @@ jobs:
     runs-on: [self-hosted, X64, Linux, clean-room, intel]
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           ref: ${{ inputs.ref || github.sha }}
       - name: Assert HEAD is ${{ inputs.ref || github.sha }}
diff --git a/.github/workflows/toolchain-ceiling.yml b/.github/workflows/toolchain-ceiling.yml
index e400cd22f9..3e8d74cf81 100644
--- a/.github/workflows/toolchain-ceiling.yml
+++ b/.github/workflows/toolchain-ceiling.yml
@@ -63,7 +63,7 @@ jobs:
     runs-on: [self-hosted, X64, Linux, clean-room]
     timeout-minutes: 45
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
       - name: Workspace builds on its DECLARED MSRV
         run: setsid --wait bash scripts/check_msrv.sh
 
@@ -75,7 +75,7 @@ jobs:
     steps:
       # clean: false — matches coverage-nightly; the default git-clean chokes on
       # root-owned leftovers from prior jobs (contracts/.pv/cache → EACCES).
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           clean: false
 
@@ -99,7 +99,7 @@ jobs:
     runs-on: [self-hosted, Linux, X64, clean-room]
     timeout-minutes: 90
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7
         with:
           clean: false
       - name: Self-test — an unreached feature is refused, and a planted cuda-only finding reddens only the cuda-reaching axes
diff --git a/.github/workflows/zizmor-nightly.yml b/.github/workflows/zizmor-nightly.yml
new file mode 100644
index 0000000000..ceb65336b9
--- /dev/null
+++ b/.github/workflows/zizmor-nightly.yml
@@ -0,0 +1,30 @@
+name: Workflow Security Lint (LAB)
+
+# LAB check (C324): runs at night only, never in a PR, merge-queue or release job,
+# and is not a required check. A red opens or updates one ticket.
+on:
+  schedule:
+    - cron: '30 3 * * *'
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+concurrency:
+  group: zizmor-nightly
+  cancel-in-progress: false
+
+jobs:
+  zizmor:
+    runs-on: [self-hosted, Linux, X64, clean-room]
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: dtolnay/rust-toolchain@b725eda525362e7cf34af9a7243cac1e3f01a7ec  # stable
+      - name: Lint every workflow (unpinned-uses is the finding this check exists for)
+        env:
+          CARGO_INSTALL_ROOT: ${{ runner.temp }}/zizmor
+        run: |
+          cargo install --locked zizmor
+          export PATH="$CARGO_INSTALL_ROOT/bin:$PATH"
+          zizmor --config .github/zizmor.yml --format plain .github/workflows
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 0000000000..619410583f
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,8 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        # Every third-party action must be pinned to a full commit sha.
+        "*": hash-pin
+        # The org's own reusable gate tracks its default branch by design.
+        paiml/.github/*: ref-pin
diff --git a/scripts/check_coverage_receipt.sh b/scripts/check_coverage_receipt.sh
index 76780e64e6..c48d77c0ec 100755
--- a/scripts/check_coverage_receipt.sh
+++ b/scripts/check_coverage_receipt.sh
@@ -109,7 +109,7 @@ UPLOAD=$(cat <<'EOF'
       - name: Publish the coverage receipt
         if: always()
         continue-on-error: true
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7
         with:
           name: coverage-receipt
           path: ${{ runner.temp }}/cov-receipt/coverage-receipt-*.json