diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 172a7da..480da1a 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -21,12 +21,12 @@ jobs:
         working-directory: ./client
     steps:
       - name: Checkout main repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           submodules: "recursive"
 
       - name: Setup flutter
-        uses: subosito/flutter-action@v2
+        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2
         with:
           channel: stable
           flutter-version: 3.35.7
@@ -55,7 +55,7 @@ jobs:
         run: flutter build ipa --release --obfuscate --split-debug-info=build/debug-info --build-number=${{ github.run_number }}
 
       - name: Upload app to TestFlight
-        uses: apple-actions/upload-testflight-build@v3
+        uses: apple-actions/upload-testflight-build@9fd28d4e690396e43caca69cef54cccccce77034 # v3
         # Mobile applications are published to the App Store manually, with release tags applied
         # post-publication. To avoid redundant uploads, this step executes only for non-tagged
         # builds, ensuring tagged releases are distributed exclusively to GitHub.
@@ -67,7 +67,7 @@ jobs:
           api-private-key: ${{ secrets.PRIVATE_KEY_CONTENTS }}
 
       - name: Upload iOS Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         if: startsWith(github.ref, 'refs/tags/')
         with:
           name: ios-app
@@ -83,7 +83,7 @@ jobs:
       run:
         working-directory: ./client
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Set up Java
         uses: actions/setup-java@v3
@@ -92,7 +92,7 @@ jobs:
           java-version: "17"
 
       - name: Setup flutter
-        uses: subosito/flutter-action@v2
+        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2
         with:
           channel: stable
           flutter-version: 3.32.7
@@ -110,7 +110,7 @@ jobs:
         run: flutter build appbundle --release --build-number=${{ github.run_number }}
 
       - name: Sign AAB
-        uses: r0adkll/sign-android-release@v1
+        uses: r0adkll/sign-android-release@349ebdef58775b1e0d8099458af0816dc79b6407 # v1
         with:
           releaseDirectory: client/build/app/outputs/bundle/release
           signingKeyBase64: "${{ secrets.ANDROID_SIGNING_KEY_BASE64 }}"
@@ -119,7 +119,7 @@ jobs:
           keyPassword: "${{ secrets.ANDROID_KEYSTORE_PASSWORD }}"
 
       - name: Publish to Play Store
-        uses: r0adkll/upload-google-play@v1
+        uses: r0adkll/upload-google-play@e738b9dd8f2476ea806d921b64aacd24f34515a5 # v1
         # Mobile applications are published to the Play Store manually, with release tags applied
         # post-publication. To avoid redundant uploads, this step executes only for non-tagged
         # builds, ensuring tagged releases are distributed exclusively to GitHub.
@@ -131,7 +131,7 @@ jobs:
           track: internal
 
       - name: Upload Android Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         if: startsWith(github.ref, 'refs/tags/')
         with:
           name: android-app
diff --git a/.github/workflows/lint-and-test.yaml b/.github/workflows/lint-and-test.yaml
index 603d5d4..13d6853 100644
--- a/.github/workflows/lint-and-test.yaml
+++ b/.github/workflows/lint-and-test.yaml
@@ -29,10 +29,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Scan code with Trivy
-        uses: aquasecurity/trivy-action@0.33.1
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           scan-type: 'fs'
           scan-ref: '.'
@@ -42,7 +42,7 @@ jobs:
           scanners: "vuln"
 
       - name: setup flutter
-        uses: subosito/flutter-action@v2
+        uses: subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2
         with:
           channel: stable
           flutter-version: 3.32.4
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 410f794..071b7cd 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -15,14 +15,14 @@ jobs:
 
     steps:
       - name: Download build artifacts
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
         with:
           path: ./artifacts
           merge-multiple: true
 
       - name: Create GitHub release
         id: release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
         with:
           draft: true
           files: |
diff --git a/.github/workflows/sbom.yaml b/.github/workflows/sbom.yaml
index 99775f0..d7d7cd7 100644
--- a/.github/workflows/sbom.yaml
+++ b/.github/workflows/sbom.yaml
@@ -31,14 +31,14 @@ jobs:
           echo "VERSION=$VERSION" >> $GITHUB_OUTPUT
 
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           submodules: recursive
           ref: ${{ steps.vars.outputs.TAG_NAME }}
           token: ${{ secrets.PRIVATE_REPO_CLONING_TOKEN }}
 
       - name: Create SBOM with Trivy
-        uses: aquasecurity/trivy-action@0.33.1
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           scan-type: 'fs'
           format: 'spdx-json'
@@ -48,7 +48,7 @@ jobs:
           scanners: "vuln"
 
       - name: Create security advisory file with Trivy
-        uses: aquasecurity/trivy-action@0.33.1
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           scan-type: 'fs'
           format: 'json'
@@ -58,7 +58,7 @@ jobs:
           scanners: "vuln"
 
       - name: Upload SBOMs and advisories
-        uses: shogo82148/actions-upload-release-asset@v1
+        uses: shogo82148/actions-upload-release-asset@394b3c11c3cfc038b5396ad265c074065cf875c3 # v1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with: