diff --git a/.github/workflows/build-s2i-python-kopf-pr.yaml b/.github/workflows/build-s2i-python-kopf-pr.yaml
index 0fc9de5cf..5f596e3ef 100644
--- a/.github/workflows/build-s2i-python-kopf-pr.yaml
+++ b/.github/workflows/build-s2i-python-kopf-pr.yaml
@@ -12,11 +12,11 @@ jobs:
       IMAGE_NAME: python-kopf-s2i
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Check and verify version.json
         id: check_version
-        uses: redhat-cop/github-actions/get-image-version@v4
+        uses: redhat-cop/github-actions/get-image-version@11f2ce27643eb7c76ac3623cb99d9b08be30d762 # v4
         with:
           IMAGE_CONTEXT_DIR: ${{ env.CONTEXT_DIR }}
 
@@ -25,7 +25,7 @@ jobs:
           sed -i -e "s/^FROM .*/FROM ${IMAGE_NAME}:${{ steps.check_version.outputs.VERSION }}/" ${CONTEXT_DIR}/examples/kopf-simple/Dockerfile
 
       - name: Build s2i image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.CONTEXT_DIR }}
           dockerfiles: |
@@ -35,7 +35,7 @@ jobs:
           tags: ${{ steps.check_version.outputs.VERSION }}
 
       - name: Build kopf-simple example from s2i image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.CONTEXT_DIR }}/examples/kopf-simple
           dockerfiles: |
diff --git a/.github/workflows/build-s2i-python-kopf-publish.yaml b/.github/workflows/build-s2i-python-kopf-publish.yaml
index c87207259..b8b341400 100644
--- a/.github/workflows/build-s2i-python-kopf-publish.yaml
+++ b/.github/workflows/build-s2i-python-kopf-publish.yaml
@@ -13,17 +13,17 @@ jobs:
       REGISTRY: ${{ secrets.REGISTRY_URI }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Get image tags
         id: image_tags
-        uses: redhat-cop/github-actions/get-image-version@v4
+        uses: redhat-cop/github-actions/get-image-version@11f2ce27643eb7c76ac3623cb99d9b08be30d762 # v4
         with:
           IMAGE_CONTEXT_DIR: ${{ env.CONTEXT_DIR }}
 
       - name: Build image
         id: build_image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.CONTEXT_DIR }}
           dockerfiles: |
@@ -32,7 +32,7 @@ jobs:
           tags: "${{ steps.image_tags.outputs.IMAGE_TAGS }}"
 
       - name: Push to ghcr.io
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ghcr.io/${{ github.repository }}
@@ -43,7 +43,7 @@ jobs:
       - name: Push to Quay
         if: ${{ env.REGISTRY }} != ""
         id: push_to_quay
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ${{ secrets.REGISTRY_URI }}/${{ secrets.REGISTRY_REPOSITORY }}
diff --git a/.github/workflows/jenkins-agent-ansible-pr.yaml b/.github/workflows/jenkins-agent-ansible-pr.yaml
index 5005312be..08afc72ab 100644
--- a/.github/workflows/jenkins-agent-ansible-pr.yaml
+++ b/.github/workflows/jenkins-agent-ansible-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: jenkins-agent-ansible
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-arachni-pr.yaml b/.github/workflows/jenkins-agent-arachni-pr.yaml
index b2216053e..f308f1f51 100644
--- a/.github/workflows/jenkins-agent-arachni-pr.yaml
+++ b/.github/workflows/jenkins-agent-arachni-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: jenkins-agent-arachni
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-argocd-pr.yaml b/.github/workflows/jenkins-agent-argocd-pr.yaml
index c841ad58d..7dcc7b2ff 100644
--- a/.github/workflows/jenkins-agent-argocd-pr.yaml
+++ b/.github/workflows/jenkins-agent-argocd-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: jenkins-agent-argocd
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-ci-pr.yaml b/.github/workflows/jenkins-agent-ci-pr.yaml
index fd19fff15..451aaec99 100644
--- a/.github/workflows/jenkins-agent-ci-pr.yaml
+++ b/.github/workflows/jenkins-agent-ci-pr.yaml
@@ -13,10 +13,10 @@ jobs:
       image_name: jenkins-agent-ansible
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-conftest-pr.yaml b/.github/workflows/jenkins-agent-conftest-pr.yaml
index 83e1c98f6..acaf46dde 100644
--- a/.github/workflows/jenkins-agent-conftest-pr.yaml
+++ b/.github/workflows/jenkins-agent-conftest-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: jenkins-agent-conftest
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-cosign-pr.yaml b/.github/workflows/jenkins-agent-cosign-pr.yaml
index 974c7939b..a8fc2086e 100644
--- a/.github/workflows/jenkins-agent-cosign-pr.yaml
+++ b/.github/workflows/jenkins-agent-cosign-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: jenkins-agent-cosign
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-erlang-pr.yaml b/.github/workflows/jenkins-agent-erlang-pr.yaml
index 528ad0ee6..5f945d6c5 100644
--- a/.github/workflows/jenkins-agent-erlang-pr.yaml
+++ b/.github/workflows/jenkins-agent-erlang-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: jenkins-agent-erlang
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-golang-pr.yaml b/.github/workflows/jenkins-agent-golang-pr.yaml
index aa35c0587..63b50ced0 100644
--- a/.github/workflows/jenkins-agent-golang-pr.yaml
+++ b/.github/workflows/jenkins-agent-golang-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: jenkins-agent-golang
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-graalvm-pr.yaml b/.github/workflows/jenkins-agent-graalvm-pr.yaml
index f471091de..4bdb21492 100644
--- a/.github/workflows/jenkins-agent-graalvm-pr.yaml
+++ b/.github/workflows/jenkins-agent-graalvm-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: jenkins-agent-graalvm
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-gradle-pr.yaml b/.github/workflows/jenkins-agent-gradle-pr.yaml
index 7a7274941..5b93086bb 100644
--- a/.github/workflows/jenkins-agent-gradle-pr.yaml
+++ b/.github/workflows/jenkins-agent-gradle-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: jenkins-agent-gradle
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-helm-pr.yaml b/.github/workflows/jenkins-agent-helm-pr.yaml
index 650eb6c30..a571c85dc 100644
--- a/.github/workflows/jenkins-agent-helm-pr.yaml
+++ b/.github/workflows/jenkins-agent-helm-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: jenkins-agent-helm
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-hugo-pr.yaml b/.github/workflows/jenkins-agent-hugo-pr.yaml
index 4928f5d32..b019af9c8 100644
--- a/.github/workflows/jenkins-agent-hugo-pr.yaml
+++ b/.github/workflows/jenkins-agent-hugo-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: jenkins-agent-hugo
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-image-mgmt-pr.yaml b/.github/workflows/jenkins-agent-image-mgmt-pr.yaml
index b870395fc..ea17540a6 100644
--- a/.github/workflows/jenkins-agent-image-mgmt-pr.yaml
+++ b/.github/workflows/jenkins-agent-image-mgmt-pr.yaml
@@ -11,16 +11,16 @@ jobs:
       image_name: jenkins-agent-image-mgmt
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Check and verify version.json
         id: check_version
-        uses: redhat-cop/github-actions/get-image-version@v4
+        uses: redhat-cop/github-actions/get-image-version@11f2ce27643eb7c76ac3623cb99d9b08be30d762 # v4
         with:
           IMAGE_CONTEXT_DIR: ${{ env.context }}
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-image-mgmt-publish.yaml b/.github/workflows/jenkins-agent-image-mgmt-publish.yaml
index e88c9dba3..a02b9b128 100644
--- a/.github/workflows/jenkins-agent-image-mgmt-publish.yaml
+++ b/.github/workflows/jenkins-agent-image-mgmt-publish.yaml
@@ -12,17 +12,17 @@ jobs:
       REGISTRY: ${{ secrets.REGISTRY_URI }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Get image tags
         id: image_tags
-        uses: redhat-cop/github-actions/get-image-version@v4
+        uses: redhat-cop/github-actions/get-image-version@11f2ce27643eb7c76ac3623cb99d9b08be30d762 # v4
         with:
           IMAGE_CONTEXT_DIR: ${{ env.context }}
 
       - name: Build image
         id: build_image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
@@ -31,7 +31,7 @@ jobs:
           tags: "${{ steps.image_tags.outputs.IMAGE_TAGS }}"
 
       - name: Push to ghcr.io
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ghcr.io/${{ github.repository }}
@@ -42,7 +42,7 @@ jobs:
       - name: Push to Quay
         if: ${{ env.REGISTRY }} != ""
         id: push_to_quay
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ${{ secrets.REGISTRY_URI }}/${{ secrets.REGISTRY_REPOSITORY }}
diff --git a/.github/workflows/jenkins-agent-mongodb-pr.yaml b/.github/workflows/jenkins-agent-mongodb-pr.yaml
index 85c2e0c5d..13abc4094 100644
--- a/.github/workflows/jenkins-agent-mongodb-pr.yaml
+++ b/.github/workflows/jenkins-agent-mongodb-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: jenkins-agent-mongodb
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-mvn-pr.yaml b/.github/workflows/jenkins-agent-mvn-pr.yaml
index 9e165868c..b6a13a2b2 100644
--- a/.github/workflows/jenkins-agent-mvn-pr.yaml
+++ b/.github/workflows/jenkins-agent-mvn-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: jenkins-agent-mvn
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-npm-pr.yaml b/.github/workflows/jenkins-agent-npm-pr.yaml
index 42d6aa721..69e24ee7d 100644
--- a/.github/workflows/jenkins-agent-npm-pr.yaml
+++ b/.github/workflows/jenkins-agent-npm-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: jenkins-agent-npm
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-python-pr.yaml b/.github/workflows/jenkins-agent-python-pr.yaml
index 8eda4359d..a7c3d819f 100644
--- a/.github/workflows/jenkins-agent-python-pr.yaml
+++ b/.github/workflows/jenkins-agent-python-pr.yaml
@@ -11,16 +11,16 @@ jobs:
       image_name: jenkins-agent-python
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Check and verify version.json
         id: check_version
-        uses: redhat-cop/github-actions/get-image-version@v4
+        uses: redhat-cop/github-actions/get-image-version@11f2ce27643eb7c76ac3623cb99d9b08be30d762 # v4
         with:
           IMAGE_CONTEXT_DIR: ${{ env.context }}
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-python-publish.yaml b/.github/workflows/jenkins-agent-python-publish.yaml
index b27ab8aa5..1235bf7a5 100644
--- a/.github/workflows/jenkins-agent-python-publish.yaml
+++ b/.github/workflows/jenkins-agent-python-publish.yaml
@@ -12,17 +12,17 @@ jobs:
       REGISTRY: ${{ secrets.REGISTRY_URI }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Get image tags
         id: image_tags
-        uses: redhat-cop/github-actions/get-image-version@v4
+        uses: redhat-cop/github-actions/get-image-version@11f2ce27643eb7c76ac3623cb99d9b08be30d762 # v4
         with:
           IMAGE_CONTEXT_DIR: ${{ env.context }}
 
       - name: Build image
         id: build_image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
@@ -31,7 +31,7 @@ jobs:
           tags: "${{ steps.image_tags.outputs.IMAGE_TAGS }}"
 
       - name: Push to ghcr.io
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ghcr.io/${{ github.repository }}
@@ -42,7 +42,7 @@ jobs:
       - name: Push to Quay
         if: ${{ env.REGISTRY }} != ""
         id: push_to_quay
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ${{ secrets.REGISTRY_URI }}/${{ secrets.REGISTRY_REPOSITORY }}
diff --git a/.github/workflows/jenkins-agent-ruby-pr.yaml b/.github/workflows/jenkins-agent-ruby-pr.yaml
index 4ac5098cf..44f8c47bb 100644
--- a/.github/workflows/jenkins-agent-ruby-pr.yaml
+++ b/.github/workflows/jenkins-agent-ruby-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: jenkins-agent-ruby
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-rust-pr.yaml b/.github/workflows/jenkins-agent-rust-pr.yaml
index a182704a2..29f33e5f3 100644
--- a/.github/workflows/jenkins-agent-rust-pr.yaml
+++ b/.github/workflows/jenkins-agent-rust-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: jenkins-agent-rust
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/jenkins-agent-zap-pr.yaml b/.github/workflows/jenkins-agent-zap-pr.yaml
index 432c52b7d..a352f427e 100644
--- a/.github/workflows/jenkins-agent-zap-pr.yaml
+++ b/.github/workflows/jenkins-agent-zap-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: jenkins-agent-zap
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/tekton-task-images-conftest-pr.yaml b/.github/workflows/tekton-task-images-conftest-pr.yaml
index a6643bdba..9fa6db372 100644
--- a/.github/workflows/tekton-task-images-conftest-pr.yaml
+++ b/.github/workflows/tekton-task-images-conftest-pr.yaml
@@ -11,7 +11,7 @@ jobs:
       image_name: conftest
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Convert VERSION to version.json
         run: |
@@ -20,12 +20,12 @@ jobs:
 
       - name: Check and verify version.json
         id: check_version
-        uses: redhat-cop/github-actions/get-image-version@v4
+        uses: redhat-cop/github-actions/get-image-version@11f2ce27643eb7c76ac3623cb99d9b08be30d762 # v4
         with:
           IMAGE_CONTEXT_DIR: ${{ env.context }}
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/tekton-task-images-conftest-publish.yaml b/.github/workflows/tekton-task-images-conftest-publish.yaml
index 51bd519bf..e590ee039 100644
--- a/.github/workflows/tekton-task-images-conftest-publish.yaml
+++ b/.github/workflows/tekton-task-images-conftest-publish.yaml
@@ -12,7 +12,7 @@ jobs:
       REGISTRY: ${{ secrets.REGISTRY_URI }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Convert VERSION to version.json
         run: |
@@ -21,13 +21,13 @@ jobs:
 
       - name: Get image tags
         id: image_tags
-        uses: redhat-cop/github-actions/get-image-version@v4
+        uses: redhat-cop/github-actions/get-image-version@11f2ce27643eb7c76ac3623cb99d9b08be30d762 # v4
         with:
           IMAGE_CONTEXT_DIR: ${{ env.context }}
 
       - name: Build image
         id: build_image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
@@ -36,7 +36,7 @@ jobs:
           tags: "${{ steps.image_tags.outputs.IMAGE_TAGS }}"
 
       - name: Push to ghcr.io
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ghcr.io/${{ github.repository }}
@@ -47,7 +47,7 @@ jobs:
       - name: Push to Quay
         if: ${{ env.REGISTRY }} != ""
         id: push_to_quay
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ${{ secrets.REGISTRY_URI }}/${{ secrets.REGISTRY_REPOSITORY }}
diff --git a/.github/workflows/tekton-task-images-helm-pr.yaml b/.github/workflows/tekton-task-images-helm-pr.yaml
index 3383b352a..53d5e2db2 100644
--- a/.github/workflows/tekton-task-images-helm-pr.yaml
+++ b/.github/workflows/tekton-task-images-helm-pr.yaml
@@ -11,7 +11,7 @@ jobs:
       image_name: helm
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Convert VERSION to version.json
         run: |
@@ -20,12 +20,12 @@ jobs:
 
       - name: Check and verify version.json
         id: check_version
-        uses: redhat-cop/github-actions/get-image-version@v4
+        uses: redhat-cop/github-actions/get-image-version@11f2ce27643eb7c76ac3623cb99d9b08be30d762 # v4
         with:
           IMAGE_CONTEXT_DIR: ${{ env.context }}
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/tekton-task-images-helm-publish.yaml b/.github/workflows/tekton-task-images-helm-publish.yaml
index 61b4ef469..901065d8d 100644
--- a/.github/workflows/tekton-task-images-helm-publish.yaml
+++ b/.github/workflows/tekton-task-images-helm-publish.yaml
@@ -12,7 +12,7 @@ jobs:
       REGISTRY: ${{ secrets.REGISTRY_URI }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Convert VERSION to version.json
         run: |
@@ -21,13 +21,13 @@ jobs:
 
       - name: Get image tags
         id: image_tags
-        uses: redhat-cop/github-actions/get-image-version@v4
+        uses: redhat-cop/github-actions/get-image-version@11f2ce27643eb7c76ac3623cb99d9b08be30d762 # v4
         with:
           IMAGE_CONTEXT_DIR: ${{ env.context }}
 
       - name: Build image
         id: build_image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
@@ -36,7 +36,7 @@ jobs:
           tags: "${{ steps.image_tags.outputs.IMAGE_TAGS }}"
 
       - name: Push to ghcr.io
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ghcr.io/${{ github.repository }}
@@ -47,7 +47,7 @@ jobs:
       - name: Push to Quay
         if: ${{ env.REGISTRY }} != ""
         id: push_to_quay
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ${{ secrets.REGISTRY_URI }}/${{ secrets.REGISTRY_REPOSITORY }}
diff --git a/.github/workflows/tookbox-pr.yaml b/.github/workflows/tookbox-pr.yaml
index 4f84bdd4a..8f4920d01 100644
--- a/.github/workflows/tookbox-pr.yaml
+++ b/.github/workflows/tookbox-pr.yaml
@@ -12,10 +12,10 @@ jobs:
       image_name: toolbox
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/ubi8-asciidoctor-pr.yaml b/.github/workflows/ubi8-asciidoctor-pr.yaml
index b90a4650b..0c20a6e9d 100644
--- a/.github/workflows/ubi8-asciidoctor-pr.yaml
+++ b/.github/workflows/ubi8-asciidoctor-pr.yaml
@@ -11,11 +11,11 @@ jobs:
       image_name: ubi8-asciidoctor
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Check and verify version.json
         id: check_version
-        uses: redhat-cop/github-actions/get-image-version@v4
+        uses: redhat-cop/github-actions/get-image-version@11f2ce27643eb7c76ac3623cb99d9b08be30d762 # v4
         with:
           IMAGE_CONTEXT_DIR: ${{ env.context }}
 
@@ -25,7 +25,7 @@ jobs:
           sudo apt-get install -y qemu-user-static
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/ubi8-asciidoctor-publish.yaml b/.github/workflows/ubi8-asciidoctor-publish.yaml
index eddd4e0b8..8043fca55 100644
--- a/.github/workflows/ubi8-asciidoctor-publish.yaml
+++ b/.github/workflows/ubi8-asciidoctor-publish.yaml
@@ -14,11 +14,11 @@ jobs:
       REGISTRY: ${{ secrets.REGISTRY_URI }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Get image tags
         id: image_tags
-        uses: redhat-cop/github-actions/get-image-version@v4
+        uses: redhat-cop/github-actions/get-image-version@11f2ce27643eb7c76ac3623cb99d9b08be30d762 # v4
         with:
           IMAGE_CONTEXT_DIR: ${{ env.context }}
 
@@ -29,7 +29,7 @@ jobs:
 
       - name: Build image
         id: build_image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
@@ -39,7 +39,7 @@ jobs:
           tags: "${{ steps.image_tags.outputs.IMAGE_TAGS }}"
 
       - name: Push to ghcr.io
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ghcr.io/${{ github.repository }}
@@ -50,7 +50,7 @@ jobs:
       - name: Push to Quay
         if: ${{ env.REGISTRY }} != ""
         id: push_to_quay
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ${{ secrets.REGISTRY_URI }}/${{ secrets.REGISTRY_REPOSITORY }}
diff --git a/.github/workflows/ubi8-bats-pr.yaml b/.github/workflows/ubi8-bats-pr.yaml
index 98e71b6d6..c7172c89b 100644
--- a/.github/workflows/ubi8-bats-pr.yaml
+++ b/.github/workflows/ubi8-bats-pr.yaml
@@ -11,16 +11,16 @@ jobs:
       image_name: ubi8-bats
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Check and verify version.json
         id: check_version
-        uses: redhat-cop/github-actions/get-image-version@v4
+        uses: redhat-cop/github-actions/get-image-version@11f2ce27643eb7c76ac3623cb99d9b08be30d762 # v4
         with:
           IMAGE_CONTEXT_DIR: ${{ env.context }}
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/ubi8-bats-publish.yaml b/.github/workflows/ubi8-bats-publish.yaml
index c1f7acd8b..637bd8ef9 100644
--- a/.github/workflows/ubi8-bats-publish.yaml
+++ b/.github/workflows/ubi8-bats-publish.yaml
@@ -12,17 +12,17 @@ jobs:
       REGISTRY: ${{ secrets.REGISTRY_URI }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Get image tags
         id: image_tags
-        uses: redhat-cop/github-actions/get-image-version@v4
+        uses: redhat-cop/github-actions/get-image-version@11f2ce27643eb7c76ac3623cb99d9b08be30d762 # v4
         with:
           IMAGE_CONTEXT_DIR: ${{ env.context }}
 
       - name: Build image
         id: build_image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
@@ -31,7 +31,7 @@ jobs:
           tags: "${{ steps.image_tags.outputs.IMAGE_TAGS }}"
 
       - name: Push to ghcr.io
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ghcr.io/${{ github.repository }}
@@ -42,7 +42,7 @@ jobs:
       - name: Push to Quay
         if: ${{ env.REGISTRY }} != ""
         id: push_to_quay
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ${{ secrets.REGISTRY_URI }}/${{ secrets.REGISTRY_REPOSITORY }}
diff --git a/.github/workflows/ubi8-git-pr.yaml b/.github/workflows/ubi8-git-pr.yaml
index 1acb80c77..c45e2e1f7 100644
--- a/.github/workflows/ubi8-git-pr.yaml
+++ b/.github/workflows/ubi8-git-pr.yaml
@@ -11,16 +11,16 @@ jobs:
       image_name: ubi8-git
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Check and verify version.json
         id: check_version
-        uses: redhat-cop/github-actions/get-image-version@v4
+        uses: redhat-cop/github-actions/get-image-version@11f2ce27643eb7c76ac3623cb99d9b08be30d762 # v4
         with:
           IMAGE_CONTEXT_DIR: ${{ env.context }}
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/ubi8-git-publish.yaml b/.github/workflows/ubi8-git-publish.yaml
index 9594d184f..323b292b3 100644
--- a/.github/workflows/ubi8-git-publish.yaml
+++ b/.github/workflows/ubi8-git-publish.yaml
@@ -12,17 +12,17 @@ jobs:
       REGISTRY: ${{ secrets.REGISTRY_URI }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Get image tags
         id: image_tags
-        uses: redhat-cop/github-actions/get-image-version@v4
+        uses: redhat-cop/github-actions/get-image-version@11f2ce27643eb7c76ac3623cb99d9b08be30d762 # v4
         with:
           IMAGE_CONTEXT_DIR: ${{ env.context }}
 
       - name: Build image
         id: build_image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
@@ -31,7 +31,7 @@ jobs:
           tags: "${{ steps.image_tags.outputs.IMAGE_TAGS }}"
 
       - name: Push to ghcr.io
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ghcr.io/${{ github.repository }}
@@ -42,7 +42,7 @@ jobs:
       - name: Push to Quay
         if: ${{ env.REGISTRY }} != ""
         id: push_to_quay
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ${{ secrets.REGISTRY_URI }}/${{ secrets.REGISTRY_REPOSITORY }}
diff --git a/.github/workflows/ubi8-google-api-python-client-pr.yaml b/.github/workflows/ubi8-google-api-python-client-pr.yaml
index 27c76b3ce..9fee72cb9 100644
--- a/.github/workflows/ubi8-google-api-python-client-pr.yaml
+++ b/.github/workflows/ubi8-google-api-python-client-pr.yaml
@@ -11,16 +11,16 @@ jobs:
       image_name: ubi8-google-api-python-client
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Check and verify version.json
         id: check_version
-        uses: redhat-cop/github-actions/get-image-version@v4
+        uses: redhat-cop/github-actions/get-image-version@11f2ce27643eb7c76ac3623cb99d9b08be30d762 # v4
         with:
           IMAGE_CONTEXT_DIR: ${{ env.context }}
 
       - name: Build image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
diff --git a/.github/workflows/ubi8-google-api-python-client-publish.yaml b/.github/workflows/ubi8-google-api-python-client-publish.yaml
index f2b574ba7..1742e70ee 100644
--- a/.github/workflows/ubi8-google-api-python-client-publish.yaml
+++ b/.github/workflows/ubi8-google-api-python-client-publish.yaml
@@ -12,17 +12,17 @@ jobs:
       REGISTRY: ${{ secrets.REGISTRY_URI }}
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4
 
       - name: Get image tags
         id: image_tags
-        uses: redhat-cop/github-actions/get-image-version@v4
+        uses: redhat-cop/github-actions/get-image-version@11f2ce27643eb7c76ac3623cb99d9b08be30d762 # v4
         with:
           IMAGE_CONTEXT_DIR: ${{ env.context }}
 
       - name: Build image
         id: build_image
-        uses: redhat-actions/buildah-build@v2
+        uses: redhat-actions/buildah-build@b4dc19b4ba891854660ab1f88a097d45aa158f76 # v2
         with:
           context: ${{ env.context }}
           dockerfiles: |
@@ -31,7 +31,7 @@ jobs:
           tags: "${{ steps.image_tags.outputs.IMAGE_TAGS }}"
 
       - name: Push to ghcr.io
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ghcr.io/${{ github.repository }}
@@ -42,7 +42,7 @@ jobs:
       - name: Push to Quay
         if: ${{ env.REGISTRY }} != ""
         id: push_to_quay
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@9986a6552bc4571882a4a67e016b17361412b4df # v2
         with:
           image: ${{ steps.build_image.outputs.image }}
           registry: ${{ secrets.REGISTRY_URI }}/${{ secrets.REGISTRY_REPOSITORY }}