diff --git a/.github/workflows/action-lint.yaml b/.github/workflows/action-lint.yaml
index 0170ca1..b02ae61 100644
--- a/.github/workflows/action-lint.yaml
+++ b/.github/workflows/action-lint.yaml
@@ -22,13 +22,13 @@ jobs:
   actionlint:
     name: 🧹 Actionlint
     if: github.event.pull_request.draft != true
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - name: 📥 Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       - name: 🐹 Setup Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
         with:
           go-version: "stable"
       - name: 🧹 Run actionlint
diff --git a/.github/workflows/ci-go.yml b/.github/workflows/ci-go.yml
index 027a28e..1f9dc0e 100644
--- a/.github/workflows/ci-go.yml
+++ b/.github/workflows/ci-go.yml
@@ -34,14 +34,14 @@ jobs:
   go-validation:
     name: Go validation (format, lint, vet, test, build)
     if: github.event.pull_request.draft != true
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 20
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
diff --git a/.github/workflows/ci-kind-acme.yml b/.github/workflows/ci-kind-acme.yml
index cf2f4af..a4ae14e 100644
--- a/.github/workflows/ci-kind-acme.yml
+++ b/.github/workflows/ci-kind-acme.yml
@@ -32,20 +32,20 @@ jobs:
   kind-acme:
     name: cert-manager gets a CryptOS certificate over ACME
     if: github.event.pull_request.draft != true
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 25
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
         with:
           go-version-file: go.mod
           cache: true
 
       - name: Cache kind, kubectl and manifests
-        uses: actions/cache@v4
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
         with:
           path: ~/.cache/cryptos-e2e-kind
           key: kind-acme-${{ runner.arch }}-${{ hashFiles('test/kind/versions.env') }}
diff --git a/.github/workflows/cron-cleanup-runs.yml b/.github/workflows/cron-cleanup-runs.yml
index 1e272b8..a4ef55a 100644
--- a/.github/workflows/cron-cleanup-runs.yml
+++ b/.github/workflows/cron-cleanup-runs.yml
@@ -28,7 +28,7 @@ concurrency:
 jobs:
   cleanup:
     name: Prune old and failed runs
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     env:
       GH_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/job-dco.yaml b/.github/workflows/job-dco.yaml
index d63e40e..0b72b8a 100644
--- a/.github/workflows/job-dco.yaml
+++ b/.github/workflows/job-dco.yaml
@@ -25,7 +25,7 @@ jobs:
   dco:
     name: ✍️ DCO sign-off
     if: github.event.pull_request.draft == false
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
       - name: ✍️ Check every commit is signed off by its author
diff --git a/.github/workflows/job-gitleaks.yaml b/.github/workflows/job-gitleaks.yaml
index d5efc68..d4a9dbd 100644
--- a/.github/workflows/job-gitleaks.yaml
+++ b/.github/workflows/job-gitleaks.yaml
@@ -24,11 +24,11 @@ jobs:
   gitleaks:
     name: 🔒 Gitleaks (secret scan)
     if: github.event.pull_request.draft != true
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
         with:
           fetch-depth: 0
       - name: Install gitleaks
diff --git a/.github/workflows/job-golic.yaml b/.github/workflows/job-golic.yaml
index 7038ade..8f6060d 100644
--- a/.github/workflows/job-golic.yaml
+++ b/.github/workflows/job-golic.yaml
@@ -21,17 +21,17 @@ jobs:
   golic:
     name: 🔏 License headers
     if: github.event.pull_request.draft != true
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803  # v6.1.0
       - name: Setup Go
-        uses: actions/setup-go@v6
+        uses: actions/setup-go@924ae3a1cded613372ab5595356fb5720e22ba16  # v6.5.0
         with:
           go-version: 'stable'
       - name: Install Task
-        uses: arduino/setup-task@v2
+        uses: arduino/setup-task@c0bc642852239c2689f73f4ea6459c29405f3c52  # v3.0.0
         with:
           # Pin an exact, existing go-task version. setup-task's `3.x` range
           # resolution mis-computes a nonexistent version (observed: v3.52.0 ->
diff --git a/.github/workflows/job-label-checker.yaml b/.github/workflows/job-label-checker.yaml
index 059e099..ec4121b 100644
--- a/.github/workflows/job-label-checker.yaml
+++ b/.github/workflows/job-label-checker.yaml
@@ -27,7 +27,7 @@ jobs:
   autolabel:
     name: Autolabel
     if: github.event.pull_request.draft != true
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       # Map the conventional-commit prefix in the PR title to a categorizing
@@ -65,7 +65,7 @@ jobs:
     # Run even if autolabel was skipped/failed; the label may already be present
     # from the PR title.
     if: always() && github.event.pull_request.draft != true
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     permissions:
       pull-requests: read
diff --git a/.github/workflows/job-label-sync.yaml b/.github/workflows/job-label-sync.yaml
index 842c89b..ac989c2 100644
--- a/.github/workflows/job-label-sync.yaml
+++ b/.github/workflows/job-label-sync.yaml
@@ -13,11 +13,11 @@ permissions:
 jobs:
   labeler:
     name: Sync labels
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
-      - uses: crazy-max/ghaction-github-labeler@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: crazy-max/ghaction-github-labeler@548a7c3603594ec17c819e1239f281a3b801ab4d  # v6.0.0
         with:
           yaml-file: .github/labels.yml
           skip-delete: false
diff --git a/.github/workflows/job-license-check.yaml b/.github/workflows/job-license-check.yaml
index 74512f1..eeca308 100644
--- a/.github/workflows/job-license-check.yaml
+++ b/.github/workflows/job-license-check.yaml
@@ -20,11 +20,11 @@ jobs:
   npm:
     name: npm dependency licenses
     if: github.event.pull_request.draft != true
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Detect package.json
         id: manifest
@@ -33,7 +33,7 @@ jobs:
 
       - name: Setup Node
         if: steps.manifest.outputs.found == 'true'
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1  # v7.1.0
         with:
           node-version: lts/*
 
@@ -51,11 +51,11 @@ jobs:
   go:
     name: Go dependency licenses
     if: github.event.pull_request.draft != true
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Detect go.mod
         id: manifest
@@ -64,7 +64,7 @@ jobs:
 
       - name: Setup Go
         if: steps.manifest.outputs.found == 'true'
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e  # v7.0.0
         with:
           go-version: 'stable'
 
diff --git a/.github/workflows/job-pr-checks.yaml b/.github/workflows/job-pr-checks.yaml
index ca158a6..2855d8d 100644
--- a/.github/workflows/job-pr-checks.yaml
+++ b/.github/workflows/job-pr-checks.yaml
@@ -18,20 +18,20 @@ jobs:
   pr-title:
     name: PR Title
     if: github.event.pull_request.draft != true
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
-      - uses: amannn/action-semantic-pull-request@v5
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50  # v6.1.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
   pr-hygiene:
     name: PR Hygiene
     if: github.event.pull_request.draft != true
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0
       - name: Scan changed files
@@ -64,7 +64,7 @@ jobs:
   pr-body:
     name: PR Body
     if: github.event.pull_request.draft != true
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     steps:
       - name: Check body
diff --git a/.github/workflows/release-drafter.yml b/.github/workflows/release-drafter.yml
index 270d719..c2073c7 100644
--- a/.github/workflows/release-drafter.yml
+++ b/.github/workflows/release-drafter.yml
@@ -24,14 +24,14 @@ jobs:
   draft:
     name: Draft release
     if: ${{ github.event.pull_request.draft != true }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     timeout-minutes: 10
     permissions:
       contents: write
       pull-requests: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           fetch-depth: 0