diff --git a/.github/actions/configure-aws-oidc/CHANGELOG.md b/.github/actions/configure-aws-oidc/CHANGELOG.md
index 1959b5d..2b0c55b 100644
--- a/.github/actions/configure-aws-oidc/CHANGELOG.md
+++ b/.github/actions/configure-aws-oidc/CHANGELOG.md
@@ -2,6 +2,14 @@
 
 All notable changes to the `configure-aws-oidc` composite action are documented in this file.
 
+## 1.0.1
+
+### Changed
+
+- Pinned all internal `uses:` steps to commit SHAs with a version comment for auditability (CORE-5974).
+- Bumped `aws-actions/configure-aws-credentials` from `v6.2.3` to `v6.2.4`.
+- `OpenSesame/gha-oidc-access/get-role-arn` remains pinned to the same commit it already used (which is ahead of that repo's stale `v2` tag) — see PR notes.
+
 ## 1.0.0
 
 ### Added
diff --git a/.github/actions/configure-aws-oidc/action.yml b/.github/actions/configure-aws-oidc/action.yml
index 8d99fea..56f1c69 100644
--- a/.github/actions/configure-aws-oidc/action.yml
+++ b/.github/actions/configure-aws-oidc/action.yml
@@ -37,7 +37,7 @@ runs:
   steps:
     - name: Create AWS role session name
       id: create-role-session-name
-      uses: OpenSesame/core-github-actions/.github/actions/create-aws-role-session-name@47e33e390ee69d31c498e32ba01f7e227b6ee864
+      uses: OpenSesame/core-github-actions/.github/actions/create-aws-role-session-name@47e33e390ee69d31c498e32ba01f7e227b6ee864 # actions/create-aws-role-session-name/1.0.0
       with:
         action: ${{ inputs.action }}
         environment: ${{ inputs.environment }}
@@ -46,14 +46,14 @@ runs:
 
     - name: Resolve AWS role
       id: get-role-arn
-      uses: OpenSesame/gha-oidc-access/get-role-arn@42e851ba54935047834bc50a3e2de800cc4952b9
+      uses: OpenSesame/gha-oidc-access/get-role-arn@42e851ba54935047834bc50a3e2de800cc4952b9 # v2.0.2
       with:
         domain: ${{ inputs.domain }}
         env: ${{ inputs.environment }}
         ORG_READ_ONLY_SSH_KEY: ${{ inputs.ORG_READ_ONLY_SSH_KEY }}
 
     - name: Configure AWS credentials
-      uses: aws-actions/configure-aws-credentials@e6de054238d6b7531b4efff3b6587d9aade6a06c
+      uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4
       with:
         role-to-assume: ${{ steps.get-role-arn.outputs.role-arn }}
         aws-region: ${{ steps.get-role-arn.outputs.region }}
diff --git a/.github/actions/upsert-pr-comment/CHANGELOG.md b/.github/actions/upsert-pr-comment/CHANGELOG.md
index e9b9dc1..b236d68 100644
--- a/.github/actions/upsert-pr-comment/CHANGELOG.md
+++ b/.github/actions/upsert-pr-comment/CHANGELOG.md
@@ -2,6 +2,12 @@
 
 All notable changes to the **upsert-pr-comment** action are documented in this file.
 
+## 1.0.1
+
+### Changed
+
+- Bumped `actions/github-script` from `v7` (Node 20, deprecated runtime) to `v9.0.0` (Node 24), pinned by commit SHA with a version comment (CORE-5974).
+
 ## 1.0.0
 
 ### Added
diff --git a/.github/actions/upsert-pr-comment/action.yml b/.github/actions/upsert-pr-comment/action.yml
index 702eba0..cf9b476 100644
--- a/.github/actions/upsert-pr-comment/action.yml
+++ b/.github/actions/upsert-pr-comment/action.yml
@@ -17,7 +17,7 @@ runs:
   using: composite
   steps:
     - name: Upsert PR summary comment
-      uses: actions/github-script@v7
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       env:
         PR_NUMBER: ${{ inputs.pr-number }}
         COMMENT_MARKER: ${{ inputs.comment-marker }}
diff --git a/.github/workflows/CHANGELOGS/run_semgrep_scan.md b/.github/workflows/CHANGELOGS/run_semgrep_scan.md
index 6a0e6bc..21c94ca 100644
--- a/.github/workflows/CHANGELOGS/run_semgrep_scan.md
+++ b/.github/workflows/CHANGELOGS/run_semgrep_scan.md
@@ -2,6 +2,12 @@
 
 All notable changes to the **run_semgrep_scan** callable workflow are documented in this file.
 
+## 1.0.2
+
+### Changed
+
+- Pinned `actions/checkout`, `actions/setup-node`, `actions/upload-artifact`, `reviewdog/action-setup`, and `actions/github-script` to Node 24-compatible releases by commit SHA (with version comments), addressing the GitHub Node 20 Actions runtime deprecation (CORE-5974).
+
 ## 1.0.1
 
 ### Changed
diff --git a/.github/workflows/deploy_feature_branch.yml b/.github/workflows/deploy_feature_branch.yml
deleted file mode 100644
index 8e3ef08..0000000
--- a/.github/workflows/deploy_feature_branch.yml
+++ /dev/null
@@ -1,138 +0,0 @@
-name: "Deploy Feature Branch to Dev"
-
-on:
-  workflow_call:
-    inputs:
-      terraform_workspace:
-        description: 'Terraform workspace'
-        required: true
-        type: string
-      terraform-root:
-        description: 'Root directory of terraform dev. When omitted, terraform/dev is used'
-        required: false
-        type: string
-        default: 'terraform/dev'
-      oidc-domain:
-        description: 'OIDC Domain. Ex: "core" or "reveng"'
-        required: true
-        type: string
-      role_session_name_suffix:
-        description: 'Suffix for the role session name'
-        required: true
-        type: string
-      deploy_fargate:
-        description: 'Deploy Fargate'
-        required: false
-        default: false
-        type: boolean
-    secrets:
-      ORG_READ_ONLY_SSH_KEY:
-        required: true
-      ORG_GITHUB_PACKAGES_READ_ONLY_TOKEN:
-        required: true
-
-    outputs:
-      name_prefix:
-        value: ${{ jobs.build_and_apply.outputs.name_prefix }}
-      api_endpoint:
-        value: ${{ jobs.build_and_apply.outputs.api_endpoint }}
-      deploy_fargate:
-        value: ${{ inputs.deploy_fargate }}
-
-permissions:
-  id-token: write
-  contents: read
-
-jobs:
-  build_and_apply:
-    runs-on: ubuntu-latest
-    environment: dev
-    outputs:
-      name_prefix: ${{ steps.build_apply.outputs.name_prefix }}
-      api_endpoint: ${{ steps.build_apply.outputs.api_endpoint }}
-      deploy_fargate: ${{ inputs.deploy_fargate }}
-
-    steps:
-      - id: get-role-arn
-        uses: OpenSesame/gha-oidc-access/get-role-arn@v2
-        with:
-          domain: ${{ inputs.oidc-domain }}
-          env: dev
-          ORG_READ_ONLY_SSH_KEY: ${{ secrets.ORG_READ_ONLY_SSH_KEY }}
-
-      - uses: aws-actions/configure-aws-credentials@v4
-        with:
-          role-to-assume: ${{ steps.get-role-arn.outputs.role-arn }}
-          role-session-name: deployBranchDev-Run${{ inputs.role_session_name_suffix }}
-          aws-region: ${{ steps.get-role-arn.outputs.region }}
-
-      - name: Actions - Checkout Repo
-        uses: actions/checkout@v4
-
-      - name: Setup Node
-        uses: actions/setup-node@v4
-        with:
-          node-version: "20.x"
-          registry-url: "https://npm.pkg.github.com"
-
-      - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v3
-        with:
-          terraform_version: 1.6.3
-          terraform_wrapper: false
-
-      - name: Login to Amazon ECR
-        if: ${{ inputs.deploy_fargate }}
-        id: login-ecr
-        uses: aws-actions/amazon-ecr-login@v1
-
-      - name: Install IUM App Packages & Build App
-        if: ${{ inputs.deploy_fargate }}
-        run: |
-          cd lambdas/user-management-api
-          npm ci
-          npm run build
-
-      - name: Build And Apply Feature Branch to Dev
-        uses: opensesame/core-github-actions/build-apply@v1
-        id: build_apply
-        with:
-          github_ssh_key: ${{ secrets.ORG_READ_ONLY_SSH_KEY }}
-          terraform_root: ${{ inputs.terraform-root }}
-          terraform_workspace: ${{ inputs.terraform_workspace }}
-          node_auth_token: ${{ secrets.ORG_GITHUB_PACKAGES_READ_ONLY_TOKEN }}
-
-      - name: Get Feature Branch Prefix
-        if: ${{ inputs.deploy_fargate }}
-        id: get_branch_prefix
-        run: |
-          FEATURE_BRANCH_ENV=$(echo "${{ github.ref }}" | awk -F'/' '{print tolower($NF)}' | tr '_' '-' | cut -c 1-15 | sed 's/-*$//')
-          echo "FEATURE_BRANCH_ENV=$FEATURE_BRANCH_ENV" >> $GITHUB_ENV
-          echo "::set-output name=feature_branch_env::$FEATURE_BRANCH_ENV"
-
-      - name: Build, Tag, and Push IUM API Image to Dev ECR
-        if: ${{ inputs.deploy_fargate }}
-        env:
-          ECR_REGISTRY: ${{ steps.login-ecr.outputs.registry }}
-          IMAGE_TAG: latest
-          ECR_REPOSITORY: ${{ env.FEATURE_BRANCH_ENV }}-ium-ecr-repository
-        run: |
-          cd lambdas/user-management-api
-          docker build -t $ECR_REPOSITORY:latest --platform linux/arm64 -f Dockerfile .
-          docker tag $ECR_REPOSITORY:$IMAGE_TAG $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
-          docker push $ECR_REGISTRY/$ECR_REPOSITORY:$IMAGE_TAG
-
-      - name: Update IUM ECS Service to use new image
-        if: ${{ inputs.deploy_fargate }}
-        env:
-          ECR_CLUSTER: ${{ env.FEATURE_BRANCH_ENV }}-ium-ecr-cluster
-          ECS_SERVICE: ${{ env.FEATURE_BRANCH_ENV }}-ium-ecs-service
-        run: |
-          aws ecs update-service --cluster $ECR_CLUSTER --service $ECS_SERVICE --force-new-deployment
-
-      - name: Deploy to Dev
-        uses: opensesame/core-github-actions/deploy@v1
-        with:
-          github_ssh_key: ${{ secrets.ORG_READ_ONLY_SSH_KEY }}
-          terraform_root: ${{ inputs.terraform-root }}
-          terraform_workspace: ${{ inputs.terraform_workspace }}
diff --git a/.github/workflows/deploy_thru_prod.yml b/.github/workflows/deploy_thru_prod.yml
index 61bb7a5..6eae617 100644
--- a/.github/workflows/deploy_thru_prod.yml
+++ b/.github/workflows/deploy_thru_prod.yml
@@ -112,13 +112,13 @@ jobs:
 
     steps:
       - name: Checkout Actions
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.commit-identifier }}
           fetch-depth: "0"
 
       - name: Create release
-        uses: ncipollo/release-action@v1
+        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
         with:
           tag: ${{ needs.Set-Release-Tag.outputs.release-tag }}
           commit: ${{ inputs.commit-identifier }}
@@ -133,7 +133,7 @@ jobs:
       BUILD_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
 
     steps:
-      - uses: mshick/add-pr-comment@v2
+      - uses: mshick/add-pr-comment@ec328af66588ab8f77cdeb2c264f14aba45bbf59 # v3.12.0
         with:
           message: |
             # :page_with_curl: Status Report :page_with_curl:
diff --git a/.github/workflows/internal_on_merge_tag_versions.yml b/.github/workflows/internal_on_merge_tag_versions.yml
index aa62379..27f899c 100644
--- a/.github/workflows/internal_on_merge_tag_versions.yml
+++ b/.github/workflows/internal_on_merge_tag_versions.yml
@@ -24,10 +24,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
 
diff --git a/.github/workflows/internal_on_pr_validate_component_version.yml b/.github/workflows/internal_on_pr_validate_component_version.yml
index 22c6f92..0665e10 100644
--- a/.github/workflows/internal_on_pr_validate_component_version.yml
+++ b/.github/workflows/internal_on_pr_validate_component_version.yml
@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Get all labels from PR
         id: get_labels
@@ -46,7 +46,7 @@ jobs:
           echo "$all_labels" > all_labels.txt
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
 
diff --git a/.github/workflows/internal_on_push_ci.yml b/.github/workflows/internal_on_push_ci.yml
index 978b080..e7666b2 100644
--- a/.github/workflows/internal_on_push_ci.yml
+++ b/.github/workflows/internal_on_push_ci.yml
@@ -18,10 +18,10 @@ jobs:
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
 
diff --git a/.github/workflows/run_semgrep_scan.yml b/.github/workflows/run_semgrep_scan.yml
index 0fc97c5..ac5be25 100644
--- a/.github/workflows/run_semgrep_scan.yml
+++ b/.github/workflows/run_semgrep_scan.yml
@@ -138,7 +138,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.commit_identifier }}
           # Full history only when diff/baseline is requested
@@ -152,7 +152,7 @@ jobs:
           commit-identifier: ${{ inputs.commit_identifier }}
 
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version-file: .nvmrc
 
@@ -184,7 +184,7 @@ jobs:
 
       - name: Upload Artifact
         if: ${{ steps.semgrep.outputs.totalFindings > 0 }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: semgrep-${{ github.run_id }}.json
           path: semgrep_results.json
@@ -193,7 +193,7 @@ jobs:
 
       - name: Set up Reviewdog
         if: ${{ steps.semgrep.outputs.totalFindings > 0 }}
-        uses: reviewdog/action-setup@v1
+        uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f # v1.5.0
         with:
           reviewdog_version: v0.20.3
 
@@ -268,7 +268,7 @@ jobs:
       - name: Generate PR comment body
         if: ${{ github.event_name == 'pull_request' || steps.pr_check.outputs.pr_exists == 'true' }}
         id: generate_body
-        uses: actions/github-script@v7
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           PR_NUMBER: ${{ steps.pr_check.outputs.pr_number }}
           SCAN_STATUS: ${{ steps.semgrep.outputs.scanStatus }}
diff --git a/.github/workflows/tf_apply.yml b/.github/workflows/tf_apply.yml
index ba6d5c4..8d59865 100644
--- a/.github/workflows/tf_apply.yml
+++ b/.github/workflows/tf_apply.yml
@@ -78,20 +78,20 @@ jobs:
 
     steps:
       - id: get-role-arn
-        uses: OpenSesame/gha-oidc-access/get-role-arn@v2
+        uses: OpenSesame/gha-oidc-access/get-role-arn@1417c02442b956045a6930e271ce134faf8e09e6 # v2
         with:
           domain: ${{ inputs.oidc-domain }}
           env: ${{ inputs.environment }}
           ORG_READ_ONLY_SSH_KEY: ${{ secrets.ORG_READ_ONLY_SSH_KEY }}
 
-      - uses: aws-actions/configure-aws-credentials@v4
+      - uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4
         with:
           role-to-assume: ${{ steps.get-role-arn.outputs.role-arn }}
           role-session-name: ${{ inputs.terraform-workspace }}-${{ inputs.environment }}-Run${{ github.run_id }}
           aws-region: ${{ steps.get-role-arn.outputs.region }}
 
       - name: Checkout Actions
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.commit-identifier }}
 
@@ -106,7 +106,7 @@ jobs:
           chmod 600 ~/.ssh/id_rsa ~/.ssh/known_hosts
 
       - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v3
+        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
         with:
           terraform_version: ${{ inputs.terraform-version }}
           terraform_wrapper: false # required to access terraform outputs after apply
diff --git a/.github/workflows/tf_validate_plan_single_root.yml b/.github/workflows/tf_validate_plan_single_root.yml
index 836e3b0..0cbede3 100644
--- a/.github/workflows/tf_validate_plan_single_root.yml
+++ b/.github/workflows/tf_validate_plan_single_root.yml
@@ -73,20 +73,20 @@ jobs:
 
     steps:
       - id: get-role-arn
-        uses: OpenSesame/gha-oidc-access/get-role-arn@v2
+        uses: OpenSesame/gha-oidc-access/get-role-arn@1417c02442b956045a6930e271ce134faf8e09e6 # v2
         with:
           domain: ${{ inputs.oidc-domain }}
           env: ${{ inputs.environment }}
           ORG_READ_ONLY_SSH_KEY: ${{ secrets.ORG_READ_ONLY_SSH_KEY }}
 
-      - uses: aws-actions/configure-aws-credentials@v4
+      - uses: aws-actions/configure-aws-credentials@cbe3b392738ccf3f987d68400dafcf4b0624a56c # v6.2.4
         with:
           role-to-assume: ${{ steps.get-role-arn.outputs.role-arn }}
           role-session-name: ${{ inputs.terraform-workspace }}-${{ inputs.environment }}-Run${{ github.run_id }}
           aws-region: ${{ steps.get-role-arn.outputs.region }}
 
       - name: Checkout Actions
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.commit-identifier }}
 
@@ -101,7 +101,7 @@ jobs:
           chmod 600 ~/.ssh/id_rsa ~/.ssh/known_hosts
 
       - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v3
+        uses: hashicorp/setup-terraform@dfe3c3f87815947d99a8997f908cb6525fc44e9e # v4.0.1
         with:
           terraform_version: ${{ inputs.terraform-version }}
           terraform_wrapper: false # required to access terraform outputs after apply
@@ -191,7 +191,7 @@ jobs:
       - name: Upload Plans to Artifact
         id: plan-artifact
         if: ${{ inputs.write-artifact }}
-        uses: actions/upload-artifact@v4.4.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{steps.set-plan-artifact-name.outputs.artifact_name}}
           path: terraform/${{ inputs.environment }}/tfplan.txt
diff --git a/package-lock.json b/package-lock.json
index 965755e..3aef33d 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -826,29 +826,43 @@
       }
     },
     "node_modules/@humanfs/core": {
-      "version": "0.19.1",
-      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.1.tgz",
-      "integrity": "sha512-5DyQ4+1JEUzejeK1JGICcideyfUbGixgS9jNgex5nqkW+cY7WZhxBigmieN5Qnw9ZosSNVC9KQKyb+GUaGyKUA==",
+      "version": "0.19.2",
+      "resolved": "https://registry.npmjs.org/@humanfs/core/-/core-0.19.2.tgz",
+      "integrity": "sha512-UhXNm+CFMWcbChXywFwkmhqjs3PRCmcSa/hfBgLIb7oQ5HNb1wS0icWsGtSAUNgefHeI+eBrA8I1fxmbHsGdvA==",
       "dev": true,
       "license": "Apache-2.0",
+      "dependencies": {
+        "@humanfs/types": "^0.15.0"
+      },
       "engines": {
         "node": ">=18.18.0"
       }
     },
     "node_modules/@humanfs/node": {
-      "version": "0.16.7",
-      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.7.tgz",
-      "integrity": "sha512-/zUx+yOsIrG4Y43Eh2peDeKCxlRt/gET6aHfaKpuq267qXdYDFViVHfMaLyygZOnl0kGWxFIgsBy8QFuTLUXEQ==",
+      "version": "0.16.8",
+      "resolved": "https://registry.npmjs.org/@humanfs/node/-/node-0.16.8.tgz",
+      "integrity": "sha512-gE1eQNZ3R++kTzFUpdGlpmy8kDZD/MLyHqDwqjkVQI0JMdI1D51sy1H958PNXYkM2rAac7e5/CnIKZrHtPh3BQ==",
       "dev": true,
       "license": "Apache-2.0",
       "dependencies": {
-        "@humanfs/core": "^0.19.1",
+        "@humanfs/core": "^0.19.2",
+        "@humanfs/types": "^0.15.0",
         "@humanwhocodes/retry": "^0.4.0"
       },
       "engines": {
         "node": ">=18.18.0"
       }
     },
+    "node_modules/@humanfs/types": {
+      "version": "0.15.0",
+      "resolved": "https://registry.npmjs.org/@humanfs/types/-/types-0.15.0.tgz",
+      "integrity": "sha512-ZZ1w0aoQkwuUuC7Yf+7sdeaNfqQiiLcSRbfI08oAxqLtpXQr9AIVX7Ay7HLDuiLYAaFPu8oBYNq/QIi9URHJ3Q==",
+      "dev": true,
+      "license": "Apache-2.0",
+      "engines": {
+        "node": ">=18.18.0"
+      }
+    },
     "node_modules/@humanwhocodes/module-importer": {
       "version": "1.0.1",
       "resolved": "https://registry.npmjs.org/@humanwhocodes/module-importer/-/module-importer-1.0.1.tgz",
diff --git a/semgrep/action.yml b/semgrep/action.yml
index 0145b10..43e9bba 100644
--- a/semgrep/action.yml
+++ b/semgrep/action.yml
@@ -70,7 +70,7 @@ runs:
         fi
 
     - name: Set up Reviewdog
-      uses: reviewdog/action-setup@v1
+      uses: reviewdog/action-setup@d8a7baabd7f3e8544ee4dbde3ee41d0011c3a93f # v1.5.0
       with:
         reviewdog_version: v0.20.3
 
@@ -161,7 +161,7 @@ runs:
 
     - name: Post success comment to PR
       if: github.event_name == 'pull_request' || github.event.pull_request
-      uses: actions/github-script@v7
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       with:
         github-token: ${{ inputs.github_token }}
         script: |
diff --git a/tf-plan-comment/action.yml b/tf-plan-comment/action.yml
index 40aab0c..b773321 100644
--- a/tf-plan-comment/action.yml
+++ b/tf-plan-comment/action.yml
@@ -12,7 +12,7 @@ runs:
   using: composite
   steps:
     - name: Upsert PR comment (Terraform plan)
-      uses: actions/github-script@v7
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       with:
         script: |
           const fs = require('fs');