diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1f5646b2..ac9a08b9 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -7,12 +7,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Set up Go
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
         go-version: '1.25' # GO_VERSION_DEF
         check-latest: true
     - name: Checkout
-      uses: actions/checkout@v1
+      uses: actions/checkout@50fbc622fc4ef5163becd7fab6573eac35f8462e # v1.2.0
       with:
         path: ./src/github.com/${{ github.repository }}
     - name: Build
@@ -24,12 +24,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Set up Go
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
         go-version: '1.25' # GO_VERSION_DEF
         check-latest: true
     - name: Checkout
-      uses: actions/checkout@v1
+      uses: actions/checkout@50fbc622fc4ef5163becd7fab6573eac35f8462e # v1.2.0
       with:
         path: ./src/github.com/${{ github.repository }}
     - name: GoReleaser Check
diff --git a/.github/workflows/cli-action.yml b/.github/workflows/cli-action.yml
index 967d0375..ad768656 100644
--- a/.github/workflows/cli-action.yml
+++ b/.github/workflows/cli-action.yml
@@ -16,6 +16,6 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Install CLI
-      uses: dopplerhq/cli-action@v4
+      uses: dopplerhq/cli-action@4819d808ab99e5cde19a0637a16536a4038fad73 # v4.0.1
     - name: Test CLI
       run: doppler --version
\ No newline at end of file
diff --git a/.github/workflows/doppler-dependencies.yml b/.github/workflows/doppler-dependencies.yml
index c7e7e919..9812caa7 100644
--- a/.github/workflows/doppler-dependencies.yml
+++ b/.github/workflows/doppler-dependencies.yml
@@ -9,4 +9,4 @@ on:
 jobs:
   dependency-review:
     name: Dependency Review
-    uses: DopplerHQ/.github/.github/workflows/dependencies.yaml@main
+    uses: DopplerHQ/.github/.github/workflows/dependencies.yaml@a529fe6298292af0b1351fd7cae8aa03e7540b2b # main
diff --git a/.github/workflows/install.yml b/.github/workflows/install.yml
index ca5c88f8..bf3900c0 100644
--- a/.github/workflows/install.yml
+++ b/.github/workflows/install.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v1
+      uses: actions/checkout@50fbc622fc4ef5163becd7fab6573eac35f8462e # v1.2.0
       with:
         path: ./src/github.com/${{ github.repository }}
     - name: Uninstall bash
@@ -34,7 +34,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v1
+      uses: actions/checkout@50fbc622fc4ef5163becd7fab6573eac35f8462e # v1.2.0
       with:
         path: ./src/github.com/${{ github.repository }}
     - name: Uninstall curl
@@ -53,7 +53,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v1
+      uses: actions/checkout@50fbc622fc4ef5163becd7fab6573eac35f8462e # v1.2.0
       with:
         path: ./src/github.com/${{ github.repository }}
     - name: Uninstall gnupg
@@ -80,7 +80,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v1
+      uses: actions/checkout@50fbc622fc4ef5163becd7fab6573eac35f8462e # v1.2.0
       with:
         path: ./src/github.com/${{ github.repository }}
     - name: Install CLI
@@ -91,7 +91,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v1
+      uses: actions/checkout@50fbc622fc4ef5163becd7fab6573eac35f8462e # v1.2.0
       with:
         path: ./src/github.com/${{ github.repository }}
     - name: Download CLI
@@ -102,7 +102,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v1
+      uses: actions/checkout@50fbc622fc4ef5163becd7fab6573eac35f8462e # v1.2.0
       with:
         path: ./src/github.com/${{ github.repository }}
     - name: Download CLI
@@ -113,7 +113,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v1
+      uses: actions/checkout@50fbc622fc4ef5163becd7fab6573eac35f8462e # v1.2.0
       with:
         path: ./src/github.com/${{ github.repository }}
     - name: Make temp directory
@@ -126,7 +126,7 @@ jobs:
     runs-on: macos-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v1
+      uses: actions/checkout@50fbc622fc4ef5163becd7fab6573eac35f8462e # v1.2.0
       with:
         path: ./src/github.com/${{ github.repository }}
     - name: Install CLI
@@ -140,7 +140,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout
-      uses: actions/checkout@v1
+      uses: actions/checkout@50fbc622fc4ef5163becd7fab6573eac35f8462e # v1.2.0
       with:
         path: ./src/github.com/${{ github.repository }}
     - name: Install CLI
@@ -155,7 +155,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout
-      uses: actions/checkout@v1
+      uses: actions/checkout@50fbc622fc4ef5163becd7fab6573eac35f8462e # v1.2.0
       with:
         path: ./src/github.com/${{ github.repository }}
     - name: Install CLI
@@ -169,7 +169,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout
-      uses: actions/checkout@v1
+      uses: actions/checkout@50fbc622fc4ef5163becd7fab6573eac35f8462e # v1.2.0
       with:
         path: ./src/github.com/${{ github.repository }}
     - name: Create user bin directory
diff --git a/.github/workflows/post-release.yml b/.github/workflows/post-release.yml
index a6f61575..3b0fbc04 100644
--- a/.github/workflows/post-release.yml
+++ b/.github/workflows/post-release.yml
@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v1
+      uses: actions/checkout@50fbc622fc4ef5163becd7fab6573eac35f8462e # v1.2.0
       with:
         path: ./src/github.com/${{ github.repository }}
     - name: Install CLI
@@ -19,7 +19,7 @@ jobs:
     runs-on: windows-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v1
+      uses: actions/checkout@50fbc622fc4ef5163becd7fab6573eac35f8462e # v1.2.0
       with:
         path: ./src/github.com/${{ github.repository }}
     - name: Install Scoop and CLI
diff --git a/.github/workflows/release-tests.yaml b/.github/workflows/release-tests.yaml
index 5e8378fd..1500def2 100644
--- a/.github/workflows/release-tests.yaml
+++ b/.github/workflows/release-tests.yaml
@@ -11,12 +11,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Set up Go
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
         go-version: '1.25' # GO_VERSION_DEF
         check-latest: true
     - name: Checkout
-      uses: actions/checkout@v1
+      uses: actions/checkout@50fbc622fc4ef5163becd7fab6573eac35f8462e # v1.2.0
       with:
         path: ./src/github.com/${{ github.repository }}
     - name: Set up QEMU
@@ -41,15 +41,15 @@ jobs:
           docker image inspect "$image" --format '{{.Architecture}}';
           docker run --rm --platform "$1" -e DOPPLER_ENABLE_VERSION_CHECK=false "$image" --version;
         done
-    - uses: actions/upload-artifact@master
+    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: macOS build (amd64)
         path: ./dist/doppler_darwin_amd64_v1/doppler
-    - uses: actions/upload-artifact@master
+    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: macOS build (arm64)
         path: ./dist/doppler_darwin_arm64/doppler
-    - uses: actions/upload-artifact@master
+    - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: Linux build (amd64)
         path: ./dist/doppler_linux_amd64_v1/doppler
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 1653e6f8..8159678c 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -24,12 +24,12 @@ jobs:
       contents: write
     steps:
       - name: Set up Go
-        uses: actions/setup-go@v3
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: "1.25" # GO_VERSION_DEF
           check-latest: true
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: "master"
           # include tags so we can determine new version
@@ -52,7 +52,7 @@ jobs:
         # docker-container driver, which this action configures by default
         uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
       - name: Install Doppler CLI
-        uses: dopplerhq/cli-action@v2
+        uses: dopplerhq/cli-action@41106dbef2e821dcf2250b0c936a616a438a278a # v2
       - name: Install Cloudsmith CLI
         run: pip install --upgrade cloudsmith-cli
       - name: Configure git
diff --git a/.github/workflows/shellcheck.yaml b/.github/workflows/shellcheck.yaml
index 1c535eeb..9376415a 100644
--- a/.github/workflows/shellcheck.yaml
+++ b/.github/workflows/shellcheck.yaml
@@ -7,7 +7,7 @@ jobs:
     runs-on: ubuntu-latest
     name: ShellCheck
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Install shellcheck
       run: sudo apt-get update && sudo apt-get install -y shellcheck
     - name: Check scripts
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index c8e7c66d..be739e05 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -11,14 +11,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Set up Go
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
         go-version: '1.25' # GO_VERSION_DEF
         check-latest: true
     - name: Install dependencies
       run: sudo DEBIAN_FRONTEND=noninteractive apt-get install -yq --no-install-recommends expect jq
     - name: Checkout
-      uses: actions/checkout@v1
+      uses: actions/checkout@50fbc622fc4ef5163becd7fab6573eac35f8462e # v1.2.0
       with:
         path: ./src/github.com/${{ github.repository }}
     - name: Build
@@ -33,12 +33,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Set up Go
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
       with:
         go-version: '1.25' # GO_VERSION_DEF
         check-latest: true
     - name: Checkout
-      uses: actions/checkout@v1
+      uses: actions/checkout@50fbc622fc4ef5163becd7fab6573eac35f8462e # v1.2.0
       with:
         path: ./src/github.com/${{ github.repository }}
     - name: Build
diff --git a/.github/workflows/vulncheck.yml b/.github/workflows/vulncheck.yml
index 8fef1652..fe059e14 100644
--- a/.github/workflows/vulncheck.yml
+++ b/.github/workflows/vulncheck.yml
@@ -15,9 +15,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code into the Go module directory
-        uses: actions/checkout@v6
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
           go-version: '1.25' # GO_VERSION_DEF
           check-latest: true
@@ -32,7 +32,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Go Supported Version
-        uses: dopplerhq/go-supported-version-check-action@v1
+        uses: dopplerhq/go-supported-version-check-action@9e57bbb76bc6b20129c0a2aaf65fd9a2b7634a6b # v1.0.0
         with:
           go-version: "1.25" # GO_VERSION_DEF
           version-requirement: any-supported