diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 46759c0..c2abb93 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -19,9 +19,9 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: "24"
           cache: "npm"
@@ -45,9 +45,9 @@ jobs:
   index-refresh:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: "24"
           cache: "npm"
@@ -62,17 +62,17 @@ jobs:
     runs-on: ubuntu-latest
     needs: test
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           path: cometchat-mcp
 
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           repository: cometchat/docs
           path: cometchat-docs
           ref: main
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: "24"
           cache: "npm"
@@ -89,7 +89,7 @@ jobs:
           INDEX_PATH: ${{ github.workspace }}/cometchat-mcp/data/index.sqlite
         run: npm run build:index
 
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: search-index
           path: cometchat-mcp/data/index.sqlite
@@ -105,7 +105,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           path: cometchat-mcp
 
@@ -122,7 +122,7 @@ jobs:
       # top-level files (docs.json), every .mdx page, and the .md files a page
       # may import as a snippet (src/search/mdx-imports.ts takes either
       # extension), so this index matches the one build-index uploads.
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           repository: cometchat/docs
           path: cometchat-docs
@@ -135,7 +135,7 @@ jobs:
             **/*.md
           sparse-checkout-cone-mode: false
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: "24"
           cache: "npm"
@@ -175,14 +175,14 @@ jobs:
         # failed build behind tee's exit status.
         shell: bash
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
-      - uses: docker/setup-buildx-action@v4
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       # `docker buildx build` in a run step cannot reach the Actions cache on
       # its own. Export only the variables its gha cache backend reads.
       - name: Expose the Actions cache to buildx
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             for (const k of ['ACTIONS_RUNTIME_TOKEN', 'ACTIONS_RESULTS_URL', 'ACTIONS_CACHE_URL', 'ACTIONS_CACHE_SERVICE_V2']) {
diff --git a/.github/workflows/publish-mcp.yml b/.github/workflows/publish-mcp.yml
index f3d574e..650cca0 100644
--- a/.github/workflows/publish-mcp.yml
+++ b/.github/workflows/publish-mcp.yml
@@ -27,7 +27,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Check server.json version matches the release tag
         if: github.event_name == 'release'
diff --git a/.github/workflows/search-eval-drift.yml b/.github/workflows/search-eval-drift.yml
index ffd4a54..c7a8cfb 100644
--- a/.github/workflows/search-eval-drift.yml
+++ b/.github/workflows/search-eval-drift.yml
@@ -26,7 +26,7 @@ jobs:
     # the 360-minute default every night.
     timeout-minutes: 20
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           path: cometchat-mcp
 
@@ -34,7 +34,7 @@ jobs:
       # top-level files (docs.json), every .mdx page, and the .md files a page
       # may import as a snippet (src/search/mdx-imports.ts takes either
       # extension).
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
         with:
           repository: cometchat/docs
           path: cometchat-docs
@@ -47,7 +47,7 @@ jobs:
             **/*.md
           sparse-checkout-cone-mode: false
 
-      - uses: actions/setup-node@v5
+      - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: "24"
           cache: "npm"