diff --git a/.github/workflows/build-and-test-go.yml b/.github/workflows/build-and-test-go.yml
index 02320100c..68a9d941d 100644
--- a/.github/workflows/build-and-test-go.yml
+++ b/.github/workflows/build-and-test-go.yml
@@ -21,19 +21,19 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
           go-version: "1.23"
           cache: false
 
       - name: foundry-toolchain
-        uses: foundry-rs/foundry-toolchain@v1.2.0
+        uses: foundry-rs/foundry-toolchain@8f1998e9878d786675189ef566a2e4bf24869773 # v1.2.0
 
       - name: Cache SP1 bindings
         id: cache-sp1
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: operator/sp1/lib/libsp1_verifier_ffi.so
           key: sp1-bindings-${{ runner.os }}-${{ hashFiles('operator/sp1/lib/**/*.rs', 'operator/sp1/lib/Cargo.*') }}
@@ -48,7 +48,7 @@ jobs:
 
       - name: Cache Risc Zero bindings
         id: cache-risc-zero
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: operator/risc_zero/lib/librisc_zero_verifier_ffi.so
           key: risc-zero-bindings-${{ runner.os }}-${{ hashFiles('operator/risc_zero/lib/**/*.rs', 'operator/risc_zero/lib/Cargo.*') }}
@@ -63,7 +63,7 @@ jobs:
 
       - name: Cache Merkle Tree bindings
         id: cache-merkle-tree
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: |
             operator/merkle_tree/lib/libmerkle_tree.so
@@ -80,7 +80,7 @@ jobs:
 
       - name: Cache Mina bindings
         id: cache-mina
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: operator/mina/lib/libmina_state_verifier_ffi.so
           key: mina-bindings-${{ runner.os }}-${{ hashFiles('operator/mina/lib/**/*.rs', 'operator/mina/lib/Cargo.*') }}
@@ -95,7 +95,7 @@ jobs:
 
       - name: Cache Mina Account bindings
         id: cache-mina-account
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: operator/mina_account/lib/libmina_account_verifier_ffi.so
           key: mina-account-bindings-${{ runner.os }}-${{ hashFiles('operator/mina_account/lib/**/*.rs', 'operator/mina_account/lib/Cargo.*') }}
diff --git a/.github/workflows/build-and-test-rust.yml b/.github/workflows/build-and-test-rust.yml
index 241e10c44..0c5ee724c 100644
--- a/.github/workflows/build-and-test-rust.yml
+++ b/.github/workflows/build-and-test-rust.yml
@@ -17,17 +17,17 @@ jobs:
     runs-on: aligned-runner
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Set up Rust
-        uses: actions-rs/toolchain@v1
+        uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1
         with:
           toolchain: 1.88.0
           components: rustfmt, clippy
           override: true
 
       - name: foundry-toolchain
-        uses: foundry-rs/foundry-toolchain@v1.2.0
+        uses: foundry-rs/foundry-toolchain@8f1998e9878d786675189ef566a2e4bf24869773 # v1.2.0
 
       # Reference: https://github.com/succinctlabs/sp1/actions/runs/8886659400/workflow#L61-L65
       - name: Install sp1 toolchain
@@ -43,7 +43,7 @@ jobs:
           ~/.risc0/bin/rzup install
 
       - name: Cache Rust dependencies
-        uses: actions/cache@v3
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: |
             ~/.cargo/registry
diff --git a/.github/workflows/build-contracts.yml b/.github/workflows/build-contracts.yml
index 033d2f86e..a99188cbe 100644
--- a/.github/workflows/build-contracts.yml
+++ b/.github/workflows/build-contracts.yml
@@ -16,10 +16,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Install Foundry
-        uses: foundry-rs/foundry-toolchain@v1
+        uses: foundry-rs/foundry-toolchain@908c540300062bd5a7e473851cdb4282204cee09 # v1
 
       - name: Build AlignedServiceManager
         run: make build_aligned_contracts
diff --git a/.github/workflows/explorer.yml b/.github/workflows/explorer.yml
index e8be3f08f..37123ce99 100644
--- a/.github/workflows/explorer.yml
+++ b/.github/workflows/explorer.yml
@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Connect to Tailscale
-        uses: tailscale/github-action@v2
+        uses: tailscale/github-action@4e4c49acaa9818630ce0bd7a564372c17e33fb4d # v2
         with:
           oauth-client-id: ${{ secrets.TS_OAUTH_CLIENT_ID }}
           oauth-secret: ${{ secrets.TS_OAUTH_SECRET }}
@@ -24,7 +24,7 @@ jobs:
           version: 1.70.0
 
       - name: Checkout Repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Display Branch Name
         env:
diff --git a/.github/workflows/foundry-gas-diff.yml b/.github/workflows/foundry-gas-diff.yml
index 287c863b3..b50e7900b 100644
--- a/.github/workflows/foundry-gas-diff.yml
+++ b/.github/workflows/foundry-gas-diff.yml
@@ -21,12 +21,12 @@ jobs:
         working-directory: ./contracts
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           submodules: recursive
 
       - name: Install Foundry
-        uses: foundry-rs/foundry-toolchain@v1.2.0
+        uses: foundry-rs/foundry-toolchain@8f1998e9878d786675189ef566a2e4bf24869773 # v1.2.0
 
       - name: Run tests
         run: forge test --gas-report > ../gasreport.ansi # <- this file name should be unique in your repository!
@@ -36,7 +36,7 @@ jobs:
           FOUNDRY_FUZZ_SEED: 0x${{ github.event.pull_request.base.sha || github.sha }}
 
       - name: Compare gas reports
-        uses: Rubilmax/foundry-gas-diff@v3.21
+        uses: Rubilmax/foundry-gas-diff@60e763d02526ee3299bd04278cb178d1547b134b # v3.21
         with:
           summaryQuantile: 0.9 # only display the 10% most significant gas diffs in the summary (defaults to 20%)
           sortCriteria: avg,max # sort diff rows by criteria
@@ -46,7 +46,7 @@ jobs:
 
       - name: Add gas diff to sticky comment
         if: github.event_name == 'pull_request' || github.event_name == 'pull_request_target'
-        uses: marocchino/sticky-pull-request-comment@v2
+        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2
         with:
           # delete the comment in case changes no longer impact gas costs
           delete: ${{ !steps.gas_diff.outputs.markdown }}
diff --git a/.github/workflows/golangci-lint.yml b/.github/workflows/golangci-lint.yml
index 75da755b1..1b25036e1 100644
--- a/.github/workflows/golangci-lint.yml
+++ b/.github/workflows/golangci-lint.yml
@@ -23,13 +23,13 @@ jobs:
     name: lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
           go-version: '1.24'
           cache: false
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v8
+        uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8
         with:
           # Require: The version of golangci-lint to use.
           # When `install-mode` is `binary` (default) the value can be v1.2 or v1.2.3 or `latest` to use the latest version.
diff --git a/.github/workflows/lint-contracts.yml b/.github/workflows/lint-contracts.yml
index 49aafc2c9..23f9190ee 100644
--- a/.github/workflows/lint-contracts.yml
+++ b/.github/workflows/lint-contracts.yml
@@ -15,10 +15,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: "20"
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 8f7d33f33..4d934dd7a 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       
       - name: Build batcher client
         run: make build_batcher_client
@@ -28,6 +28,6 @@ jobs:
         run: mv crates/target/release/aligned ${{ matrix.artifact_name }}
   
       - name: Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
         with:
           files: ${{ matrix.artifact_name }}
diff --git a/.github/workflows/send-proofs-docker.yml b/.github/workflows/send-proofs-docker.yml
index 84641479c..60f4fee51 100644
--- a/.github/workflows/send-proofs-docker.yml
+++ b/.github/workflows/send-proofs-docker.yml
@@ -24,14 +24,14 @@ jobs:
 
     steps:
     - name: Log in to GitHub Container Registry
-      uses: docker/login-action@v3
+      uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
       with:
         registry: ghcr.io
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
 
     - name: Checkout
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
       with:
         submodules: recursive
 
diff --git a/.github/workflows/test-merkle-tree.yml b/.github/workflows/test-merkle-tree.yml
index 098c6903b..cb202895f 100644
--- a/.github/workflows/test-merkle-tree.yml
+++ b/.github/workflows/test-merkle-tree.yml
@@ -24,12 +24,12 @@ jobs:
             sudo rm -rf /usr/share/dotnet
             sudo rm -rf /opt/ghc
             sudo rm -rf "/usr/local/share/boost"
-        - uses: actions/checkout@v4
-        - uses: actions/setup-go@v5
+        - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
           with:
             go-version: '1.22'
             cache: false
-        - uses: actions-rs/toolchain@v1
+        - uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1
           with:
             toolchain: stable
         - name: Test Merkle Tree Rust
diff --git a/.github/workflows/test-mina.yml b/.github/workflows/test-mina.yml
index ef9be4740..cafb2693e 100644
--- a/.github/workflows/test-mina.yml
+++ b/.github/workflows/test-mina.yml
@@ -15,12 +15,12 @@ jobs:
     test:
       runs-on: ubuntu-latest
       steps:
-        - uses: actions/checkout@v4
-        - uses: actions/setup-go@v5
+        - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
           with:
             go-version: '1.22'
             cache: false
-        - uses: actions-rs/toolchain@v1
+        - uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1
           with:
             toolchain: stable
         - name: Test Mina Rust
diff --git a/.github/workflows/test-risc-zero.yml b/.github/workflows/test-risc-zero.yml
index b74b71d65..cebdff355 100644
--- a/.github/workflows/test-risc-zero.yml
+++ b/.github/workflows/test-risc-zero.yml
@@ -24,12 +24,12 @@ jobs:
           sudo rm -rf /usr/share/dotnet
           sudo rm -rf /opt/ghc
           sudo rm -rf "/usr/local/share/boost"
-      - uses: actions/checkout@v4
-      - uses: actions/setup-go@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
         with:
           go-version: "1.23"
           cache: false
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1
         with:
           toolchain: stable
       - name: Test Risc Zero Rust
diff --git a/.github/workflows/test-sp1.yml b/.github/workflows/test-sp1.yml
index 1ad763c9b..54f4e92f3 100644
--- a/.github/workflows/test-sp1.yml
+++ b/.github/workflows/test-sp1.yml
@@ -15,12 +15,12 @@ jobs:
     test:
       runs-on: ubuntu-latest
       steps:
-        - uses: actions/checkout@v4
-        - uses: actions/setup-go@v5
+        - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
           with:
             go-version: '1.22'
             cache: false
-        - uses: actions-rs/toolchain@v1
+        - uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1
           with:
             toolchain: stable
         - name: Test SP1 Rust