diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0ac4b0b5..daa379f2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,7 +12,7 @@ jobs:
     name: Compile Check
     runs-on: mempool-ci
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Setup Rust
         uses: './.github/actions/ci-rust-setup'
         with:
@@ -23,7 +23,7 @@ jobs:
     name: Formatter
     runs-on: mempool-ci
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Setup Rust
         uses: './.github/actions/ci-rust-setup'
         with:
@@ -34,7 +34,7 @@ jobs:
     name: Run Tests
     runs-on: mempool-ci
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Setup Rust
         uses: './.github/actions/ci-rust-setup'
         with:
@@ -47,9 +47,9 @@ jobs:
     env:
       FREEBSD_VER: "14.3"
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Cache dependencies for FreeBSD
-      uses: actions/cache@v3
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: |
           .cargohome/registry
@@ -57,7 +57,7 @@ jobs:
           target
         key: freebsd-${{ env.FREEBSD_VER }}-cargo-checks-${{ hashFiles('**/Cargo.lock') }}
     - name: Compile Checks in FreeBSD
-      uses: vmactions/freebsd-vm@v1
+      uses: vmactions/freebsd-vm@83b151f58c6047089f4c80eb5ba2039d158ce093 # v1.5.3
       with:
         usesh: true
         release: "${{ env.FREEBSD_VER }}"
@@ -97,7 +97,7 @@ jobs:
           '-F electrum-discovery,liquid',
         ]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Setup Rust
         uses: './.github/actions/ci-rust-setup'
         with:
diff --git a/.github/workflows/on-tag.yml b/.github/workflows/on-tag.yml
index c587c80b..ee061d6c 100644
--- a/.github/workflows/on-tag.yml
+++ b/.github/workflows/on-tag.yml
@@ -42,21 +42,21 @@ jobs:
         run: echo "${{ secrets.DOCKER_PASSWORD }}" | docker login -u "${{ secrets.DOCKER_USERNAME }}" --password-stdin
 
       - name: Checkout project
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
         id: qemu
 
       - name: Setup Docker buildx action
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
         id: buildx
 
       - name: Available platforms
         run: echo ${{ steps.buildx.outputs.platforms }}
 
       - name: Cache Docker layers
-        uses: actions/cache@v3
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: cache
         with:
           path: /tmp/.buildx-cache
diff --git a/.github/workflows/project-review-status.yml b/.github/workflows/project-review-status.yml
index fa9e1184..7ff6f354 100644
--- a/.github/workflows/project-review-status.yml
+++ b/.github/workflows/project-review-status.yml
@@ -6,9 +6,12 @@ on:
   issues:
     types: [opened]
 
+permissions:
+  contents: read
+
 jobs:
   project-automation:
-    uses: mempool/.github/.github/workflows/project-board-automation.yml@master
+    uses: mempool/.github/.github/workflows/project-board-automation.yml@1b41bb42b0876d8469dc5c5878711aeffb678266 # master
     with:
       project-number: 8
     secrets: