diff --git a/.github/workflows/generate-sboms.yml b/.github/workflows/generate-sboms.yml
index 0cb0fc5ee6..6440dc0875 100644
--- a/.github/workflows/generate-sboms.yml
+++ b/.github/workflows/generate-sboms.yml
@@ -12,10 +12,14 @@ env:
 jobs:
   generate-sboms:
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
 
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false  # do not keep the token around
 
       - name: Ensure INPUTS_PATH directory exists
         run: mkdir -p "${{ env.INPUTS_PATH }}"
@@ -32,7 +36,7 @@ jobs:
           find scancodeio/ -type f -name "*.ABOUT" -exec cp {} "${{ env.INPUTS_PATH }}/about-files/" \;
 
       - name: Resolve the dependencies using ScanCode-action
-        uses: aboutcode-org/scancode-action@main
+        uses: aboutcode-org/scancode-action@8adbf888f487c3cdf6c15386035769cd03a94c66
         with:
           pipelines: "resolve_dependencies:DynamicResolver"
           inputs-path: ${{ env.INPUTS_PATH }}
diff --git a/.github/workflows/pr-quality.yml b/.github/workflows/pr-quality.yml
index 0eaa5b048b..1e938fe95e 100644
--- a/.github/workflows/pr-quality.yml
+++ b/.github/workflows/pr-quality.yml
@@ -6,6 +6,9 @@ permissions:
   pull-requests: write
 
 on:
+  # pull_request_target is required so the action can close/comment on fork PRs.
+  # This is safe because: no untrusted code is checked out, and no attacker-controlled
+  # values are interpolated into shell commands. All action inputs are hardcoded.
   pull_request_target:
     types: [opened, reopened]
 
@@ -14,7 +17,7 @@ jobs:
     runs-on: ubuntu-24.04
     name: Detects and automatically closes low-quality and AI slop PRs
     steps:
-      - uses: peakoss/anti-slop@v0
+      - uses: peakoss/anti-slop@e158eeefe5c43e1d3ba8533b84e0e35d9d6761de
         with:
           # Number of check failures needed before failure actions are triggered
           max-failures: 3
diff --git a/.github/workflows/publish-docker-image.yml b/.github/workflows/publish-docker-image.yml
index be24c863d8..9bc575214e 100644
--- a/.github/workflows/publish-docker-image.yml
+++ b/.github/workflows/publish-docker-image.yml
@@ -22,15 +22,19 @@ jobs:
     permissions:
       contents: read
       packages: write
+      attestations: write
+      id-token: write
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false  # do not keep the token around
 
       # Uses the `docker/login-action` action to log in to the Container registry using
       # the account and password that will publish the packages.
       - name: Log in to the Container registry
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9  # v3.7.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
@@ -42,7 +46,7 @@ jobs:
       # The `images` value provides the base name for the tags and labels.
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051  # v5.10.0
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
 
@@ -53,11 +57,22 @@ jobs:
       # It uses the `tags` and `labels` parameters to tag and label the image with
       # the output from the "meta" step.
       - name: Build and push Docker image
-        uses: docker/build-push-action@v5
+        id: push
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8  # v6.19.2
         with:
           context: .
           push: true
           tags: |
             ${{ steps.meta.outputs.tags }}
-            ${{ env.REGISTRY }}/aboutcode-org/scancode.io:latest
+            ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:latest
           labels: ${{ steps.meta.outputs.labels }}
+
+      # This step generates an artifact attestation for the image, which is an
+      # unforgeable statement about where and how it was built.
+      # It increases supply chain security for people who consume the image.
+      - name: Generate artifact attestation
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32  #  v4.1.0
+        with:
+          subject-name: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME}}
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true
diff --git a/.github/workflows/publish-pypi-release-aboutcode-pipeline.yml b/.github/workflows/publish-pypi-release-aboutcode-pipeline.yml
index cef72ed191..62ff6c388c 100644
--- a/.github/workflows/publish-pypi-release-aboutcode-pipeline.yml
+++ b/.github/workflows/publish-pypi-release-aboutcode-pipeline.yml
@@ -7,32 +7,56 @@ on:
       - "aboutcode.pipeline/*"
 
 jobs:
-  build-and-publish:
+  build:
     name: Build and publish library to PyPI
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false  # do not keep the token around
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
         with:
           python-version: 3.14
 
       - name: Install flot
-        run: python -m pip install flot --user
+        run: python -m pip install flot==0.7.2 --user
 
       - name: Build a binary wheel and a source tarball
         run: python -m flot --pyproject pipeline-pyproject.toml --sdist --wheel --output-dir dist/
 
-      - name: Publish to PyPI
-        if: startsWith(github.ref, 'refs/tags')
-        uses: pypa/gh-action-pypi-publish@release/v1
+      - name: Upload package distributions as GitHub workflow artifacts
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
         with:
-          password: ${{ secrets.PYPI_API_TOKEN_ABOUTCODE_PIPELINE }}
+          name: python-package-distributions
+          path: dist/
+
+  # Only set the id-token: write permission in the job that does publishing, not globally.
+  # Also, separate building from publishing — this makes sure that any scripts
+  # maliciously injected into the build or test environment won't be able to elevate
+  # privileges while flying under the radar.
+  pypi-publish:
+    name: Upload package distributions to PyPI
+    if: startsWith(github.ref, 'refs/tags/')  # only publish to PyPI on tag pushes
+    needs:
+      - build
+    runs-on: ubuntu-24.04
+    environment:
+      name: pypi
+      url: https://pypi.org/p/aboutcode.pipeline
+    permissions:
+      id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
 
-      - name: Upload built archives
-        uses: actions/upload-artifact@v4
+    steps:
+      - name: Download all the dists
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3  # v8.0.0
         with:
-          name: pypi_archives
-          path: dist/*
+          name: python-package-distributions
+          path: dist/
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e  # v1.13.0
diff --git a/.github/workflows/publish-pypi-release.yml b/.github/workflows/publish-pypi-release.yml
index 7d13564a9c..2e5163a147 100644
--- a/.github/workflows/publish-pypi-release.yml
+++ b/.github/workflows/publish-pypi-release.yml
@@ -1,4 +1,4 @@
-name: Build Python distributions and publish on PyPI
+name: Build Python distributions, publish on PyPI, and create a GH release
 
 on:
   workflow_dispatch:
@@ -6,16 +6,24 @@ on:
     tags:
       - "v*.*.*"
 
+env:
+  PYPI_PROJECT_URL: "https://pypi.org/p/scancodeio"
+
 jobs:
-  build-and-publish:
-    name: Build and publish library to PyPI
+  build-python-dist:
+    name: Build Python distributions
     runs-on: ubuntu-24.04
+    permissions:
+      contents: read
 
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false  # do not keep the token around
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
         with:
           python-version: 3.14
 
@@ -23,23 +31,56 @@ jobs:
         run: python -m pip install build --user
 
       - name: Build a binary wheel and a source tarball
-        run: python -m build --sdist --wheel --outdir dist/ .
+        run: python -m build --sdist --wheel --outdir dist/
 
-      - name: Publish to PyPI
-        if: startsWith(github.ref, 'refs/tags')
-        uses: pypa/gh-action-pypi-publish@release/v1
+      - name: Upload package distributions as GitHub workflow artifacts
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
         with:
-          password: ${{ secrets.PYPI_API_TOKEN }}
+          name: python-package-distributions
+          path: dist/
 
-      - name: Upload built archives
-        uses: actions/upload-artifact@v4
+  # Only set the id-token: write permission in the job that does publishing, not globally.
+  # Also, separate building from publishing — this makes sure that any scripts
+  # maliciously injected into the build or test environment won't be able to elevate
+  # privileges while flying under the radar.
+  pypi-publish:
+    name: Upload package distributions to PyPI
+    if: startsWith(github.ref, 'refs/tags/')  # only publish to PyPI on tag pushes
+    needs:
+      - build-python-dist
+    runs-on: ubuntu-24.04
+    environment:
+      name: pypi
+      url: ${{ env.PYPI_PROJECT_URL }}
+    permissions:
+      id-token: write  # IMPORTANT: this permission is mandatory for trusted publishing
+
+    steps:
+      - name: Download package distributions
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3  # v8.0.0
         with:
-          name: pypi_archives
-          path: dist/*
+          name: python-package-distributions
+          path: dist/
 
-      - name: Create a GitHub release
-        uses: softprops/action-gh-release@v2
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e  # v1.13.0
+
+  create-gh-release:
+    name: Create GitHub release
+    needs:
+      - build-python-dist
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+
+    steps:
+      - name: Download package distributions
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3  # v8.0.0
         with:
-          generate_release_notes: true
-          draft: false
-          files: dist/*
+          name: python-package-distributions
+          path: dist/
+
+      - name: Create GitHub release
+        run: gh release create "$GITHUB_REF_NAME" dist/* --generate-notes
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/run-unit-tests-docker.yml b/.github/workflows/run-unit-tests-docker.yml
index 609fdfab09..73a20835c3 100644
--- a/.github/workflows/run-unit-tests-docker.yml
+++ b/.github/workflows/run-unit-tests-docker.yml
@@ -15,8 +15,10 @@ jobs:
     runs-on: ubuntu-24.04
 
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false  # do not keep the token around
 
       - name: Generate the .env file and the SECRET_KEY
         run: make envfile
diff --git a/.github/workflows/run-unit-tests-macos.yml b/.github/workflows/run-unit-tests-macos.yml
index df128bfa6a..b48dc764fd 100644
--- a/.github/workflows/run-unit-tests-macos.yml
+++ b/.github/workflows/run-unit-tests-macos.yml
@@ -24,16 +24,18 @@ jobs:
         python-version: ["3.12", "3.13", "3.14"]
 
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false  # do not keep the token around
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
 
       - name: Set up PostgreSQL
-        uses: ikalnytskyi/action-setup-postgres@v8
+        uses: ikalnytskyi/action-setup-postgres@c4dda34aae1c821e3a771b68b73b13af3198a7ee  # v8
         with:
           postgres-version: "17"
           database: ${{ env.POSTGRES_DB }}
diff --git a/.github/workflows/run-unit-tests.yml b/.github/workflows/run-unit-tests.yml
index 2d8c286ca0..59c9f6657f 100644
--- a/.github/workflows/run-unit-tests.yml
+++ b/.github/workflows/run-unit-tests.yml
@@ -22,7 +22,7 @@ jobs:
 
     services:
       postgres:
-        image: postgres:17
+        image: postgres:17.9
         env:
           POSTGRES_DB: ${{ env.POSTGRES_DB }}
           POSTGRES_USER: ${{ env.POSTGRES_USER }}
@@ -42,11 +42,13 @@ jobs:
         python-version: ["3.12", "3.13", "3.14"]
 
     steps:
-      - name: Checkout code
-        uses: actions/checkout@v4
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false  # do not keep the token around
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405  # v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
 
diff --git a/.github/workflows/sca-integration-anchore.yml b/.github/workflows/sca-integration-anchore.yml
index d8ac014829..f57339fd02 100644
--- a/.github/workflows/sca-integration-anchore.yml
+++ b/.github/workflows/sca-integration-anchore.yml
@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Generate CycloneDX SBOM with Anchore Grype scanner
-        uses: anchore/scan-action@v6
+        uses: anchore/scan-action@7037fa011853d5a11690026fb85feee79f4c946c  # v7.3.2
         with:
           image: ${{ env.IMAGE_REFERENCE }}
           output-format: cyclonedx-json
@@ -36,14 +36,14 @@ jobs:
           fail-build: false
 
       - name: Upload SBOM as GitHub Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
         with:
           name: anchore-sbom-report
           path: "anchore-grype-sbom.cdx.json"
           retention-days: 20
 
       - name: Import SBOM into ScanCode.io
-        uses: aboutcode-org/scancode-action@main
+        uses: aboutcode-org/scancode-action@8adbf888f487c3cdf6c15386035769cd03a94c66
         with:
           pipelines: "load_sbom"
           inputs-path: "anchore-grype-sbom.cdx.json"
diff --git a/.github/workflows/sca-integration-cdxgen.yml b/.github/workflows/sca-integration-cdxgen.yml
index ad7f050fac..ded93df560 100644
--- a/.github/workflows/sca-integration-cdxgen.yml
+++ b/.github/workflows/sca-integration-cdxgen.yml
@@ -28,7 +28,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Install CycloneDX cdxgen
-        run: npm install @cyclonedx/cdxgen
+        run: npm install @cyclonedx/cdxgen@12.1.2
 
       - name: Generate SBOM with CycloneDX cdxgen
         run: |
@@ -39,14 +39,14 @@ jobs:
             --json-pretty
 
       - name: Upload SBOM as GitHub Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
         with:
           name: cdxgen-sbom
           path: "cdxgen-sbom.cdx.json"
           retention-days: 20
 
       - name: Import SBOM into ScanCode.io
-        uses: aboutcode-org/scancode-action@main
+        uses: aboutcode-org/scancode-action@8adbf888f487c3cdf6c15386035769cd03a94c66
         with:
           pipelines: "load_sbom"
           inputs-path: "cdxgen-sbom.cdx.json"
diff --git a/.github/workflows/sca-integration-cyclonedx-gomod.yml b/.github/workflows/sca-integration-cyclonedx-gomod.yml
index bbbf724f7c..ea39bd659f 100644
--- a/.github/workflows/sca-integration-cyclonedx-gomod.yml
+++ b/.github/workflows/sca-integration-cyclonedx-gomod.yml
@@ -27,25 +27,26 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout minimal Go repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           repository: opencontainers/runc
+          persist-credentials: false  # do not keep the token around
 
       - name: Generate SBOM with cyclonedx-gomod
-        uses: CycloneDX/gh-gomod-generate-sbom@v2
+        uses: CycloneDX/gh-gomod-generate-sbom@efc74245d6802c8cefd925620515442756c70d8f  # v2.0.0
         with:
           version: v1
           args: mod -licenses -json -output gomod-sbom.cdx.json
 
       - name: Upload SBOM as GitHub Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
         with:
           name: sbom-report
           path: "gomod-sbom.cdx.json"
           retention-days: 20
 
       - name: Import SBOM into ScanCode.io
-        uses: aboutcode-org/scancode-action@main
+        uses: aboutcode-org/scancode-action@8adbf888f487c3cdf6c15386035769cd03a94c66
         with:
           pipelines: "load_sbom"
           inputs-path: "gomod-sbom.cdx.json"
diff --git a/.github/workflows/sca-integration-depscan.yml b/.github/workflows/sca-integration-depscan.yml
index 6b824a6a60..76cb16aace 100644
--- a/.github/workflows/sca-integration-depscan.yml
+++ b/.github/workflows/sca-integration-depscan.yml
@@ -29,8 +29,8 @@ jobs:
     steps:
       - name: Install OWASP dep-scan
         run: |
-          sudo npm install -g @cyclonedx/cdxgen
-          pip install owasp-depscan
+          sudo npm install -g @cyclonedx/cdxgen@12.1.2
+          pip install owasp-depscan==6.1.0
 
       - name: Generate SBOM with OWASP dep-scan
         run: |
@@ -41,7 +41,7 @@ jobs:
             --explain
 
       - name: Upload SBOM as GitHub Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
         with:
           name: depscan-sbom
           path: reports/
@@ -51,7 +51,7 @@ jobs:
         run: pip uninstall --yes owasp-depscan
 
       - name: Import SBOM into ScanCode.io
-        uses: aboutcode-org/scancode-action@main
+        uses: aboutcode-org/scancode-action@8adbf888f487c3cdf6c15386035769cd03a94c66
         with:
           pipelines: "load_sbom"
           inputs-path: "reports/sbom-docker.vdr.json"
diff --git a/.github/workflows/sca-integration-ort-package-file.yml b/.github/workflows/sca-integration-ort-package-file.yml
index 50cc4780dc..14ee50419d 100644
--- a/.github/workflows/sca-integration-ort-package-file.yml
+++ b/.github/workflows/sca-integration-ort-package-file.yml
@@ -17,49 +17,49 @@ permissions:
 
 env:
   SCIO_IMAGE_INPUT: "docker://osadl/alpine-docker-base-image:v3.22-latest"
-  ORT_VERSION: "68.1.0"
+  ORT_VERSION: "82.0.0"
 
 jobs:
   generate-and-load-sbom:
     runs-on: ubuntu-24.04
     steps:
       - name: Analyze Docker image with ScanCode.io
-        uses: aboutcode-org/scancode-action@main
+        uses: aboutcode-org/scancode-action@8adbf888f487c3cdf6c15386035769cd03a94c66
         with:
           pipelines: "analyze_docker_image"
           input-urls:
             "${{ env.SCIO_IMAGE_INPUT }}"
           scancodeio-repo-branch: "main"
-          output-formats: "ort-package-list spdx:2.2 cyclonedx json xlsx"
+          output-formats: "ort-package-list"
 
       - name: Copy package-list.yml to workspace root
         run: |
-          FILE=$(ls ${{ env.PROJECT_WORK_DIRECTORY }}/output/*.package-list.yml | head -n 1)
-          sudo mkdir -p ${GITHUB_WORKSPACE}/ort-data/
+          FILE=$(ls "${PROJECT_WORK_DIRECTORY}/output/"*.package-list.yml | head -n 1)
+          sudo mkdir -p "${GITHUB_WORKSPACE}/ort-data/"
           sudo cp "$FILE" "${GITHUB_WORKSPACE}/ort-data/package-list.yml"
-          sudo chmod -R 777 ${GITHUB_WORKSPACE}/ort-data/
+          sudo chmod -R 777 "${GITHUB_WORKSPACE}/ort-data/"
           ls -lh "${GITHUB_WORKSPACE}/ort-data/"
 
       - name: Generates an ORT analyzer-result.yml file
         run: |
-          docker run --rm -v ${GITHUB_WORKSPACE}/ort-data:/data \
+          docker run --rm -v "${GITHUB_WORKSPACE}/ort-data:/data" \
             --entrypoint /opt/ort/bin/orth \
-            ghcr.io/oss-review-toolkit/ort:${{ env.ORT_VERSION }} \
+            "ghcr.io/oss-review-toolkit/ort:${ORT_VERSION}" \
             create-analyzer-result-from-package-list \
               --package-list-file /data/package-list.yml \
               --ort-file /data/analyzer-result.yml
 
       - name: Report as CycloneDX and SPDX using the analyzer-result.yml file
         run: |
-          docker run --rm -v ${GITHUB_WORKSPACE}/ort-data:/data \
-          ghcr.io/oss-review-toolkit/ort:${{ env.ORT_VERSION }} \
+          docker run --rm -v "${GITHUB_WORKSPACE}/ort-data:/data" \
+          "ghcr.io/oss-review-toolkit/ort:${ORT_VERSION}" \
           report \
             --ort-file /data/analyzer-result.yml \
             --output-dir /data/results/ \
             --report-formats CycloneDX,SpdxDocument
 
       - name: Upload SBOMs as GitHub Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
         with:
           name: ort-report
           path: "${GITHUB_WORKSPACE}/ort-data/results"
diff --git a/.github/workflows/sca-integration-ort.yml b/.github/workflows/sca-integration-ort.yml
index 2c777845ff..25f5d82fe4 100644
--- a/.github/workflows/sca-integration-ort.yml
+++ b/.github/workflows/sca-integration-ort.yml
@@ -21,11 +21,13 @@ jobs:
   checkout-ort-test-assets-from-scancode-io-repo:
     runs-on: ubuntu-24.04
     steps:
-      - name: Checkout ScanCode.io repository
-        uses: actions/checkout@v5
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false  # do not keep the token around
 
       - name: Upload orthw mime types example
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
         with:
           name: npm-mime-types-2.1.26-scan-result.json
           path: scanpipe/tests/data/integrations-ort/orthw-example-scan-result/npm-mime-types-2.1.26-scan-result.json
@@ -44,7 +46,7 @@ jobs:
           EOF
 
       - name: Run GitHub Action for ORT
-        uses: oss-review-toolkit/ort-ci-github-action@v1
+        uses: oss-review-toolkit/ort-ci-github-action@1805edcf1f4f55f35ae6e4d2d9795ccfb29b6021  # v1.1.0
         with:
           ort-cli-report-args: "-O CycloneDX=output.file.formats=json -O CycloneDX=schema.version=1.5"
           report-formats: "CycloneDx"
@@ -55,7 +57,7 @@ jobs:
             reporter
 
       - name: Import SBOM into ScanCode.io
-        uses: aboutcode-org/scancode-action@main
+        uses: aboutcode-org/scancode-action@8adbf888f487c3cdf6c15386035769cd03a94c66
         with:
           pipelines: "load_sbom"
           inputs-path: "${{ env.ORT_RESULTS_PATH }}/bom.cyclonedx.json"
@@ -83,7 +85,7 @@ jobs:
           EOF
 
       - name: Run GitHub Action for ORT
-        uses: oss-review-toolkit/ort-ci-github-action@v1
+        uses: oss-review-toolkit/ort-ci-github-action@1805edcf1f4f55f35ae6e4d2d9795ccfb29b6021  # v1.1.0
         with:
           ort-cli-report-args: "-O CycloneDX=output.file.formats=json -O CycloneDX=schema.version=1.6"
           report-formats: "CycloneDx"
@@ -94,7 +96,7 @@ jobs:
             reporter
 
       - name: Import SBOM into ScanCode.io
-        uses: aboutcode-org/scancode-action@main
+        uses: aboutcode-org/scancode-action@8adbf888f487c3cdf6c15386035769cd03a94c66
         with:
           pipelines: "load_sbom"
           inputs-path: "${{ env.ORT_RESULTS_PATH }}/bom.cyclonedx.json"
@@ -114,7 +116,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Download mime-type-2.1.26-scan-result file
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3  # v8.0.0
         with:
           name: npm-mime-types-2.1.26-scan-result.json
 
@@ -126,16 +128,16 @@ jobs:
           cat $HOME/.ort/ort-results/current-result.json
 
       - name: Run GitHub Action for ORT
-        uses: oss-review-toolkit/ort-ci-github-action@v1
+        uses: oss-review-toolkit/ort-ci-github-action@1805edcf1f4f55f35ae6e4d2d9795ccfb29b6021  # v1.1.0
         with:
           report-formats: "CycloneDx,SpdxDocument"
           run: >
             evaluator,
             advisor,
             reporter
-            - name: Upload orthw mime type example
 
-      - uses: actions/upload-artifact@v4
+      - name: Upload orthw mime type example
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
         with:
           name: npm-mime-types-2.1.26-ort-sboms
           path: |
@@ -151,12 +153,12 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Download ORT CycloneDX JSON SBOM for mime-types 2.1.26
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3  # v8.0.0
         with:
           name: npm-mime-types-2.1.26-ort-sboms
 
       - name: Import SBOM into ScanCode.io
-        uses: aboutcode-org/scancode-action@main
+        uses: aboutcode-org/scancode-action@8adbf888f487c3cdf6c15386035769cd03a94c66
         with:
           pipelines: "load_sbom"
           inputs-path: "bom.cyclonedx.json"
@@ -177,12 +179,12 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
      - name: Download ORT CycloneDX JSON SBOM for mime-types 2.1.26
-       uses: actions/download-artifact@v5
+       uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3  # v8.0.0
        with:
          name: npm-mime-types-2.1.26-ort-sboms
 
      - name: Import SBOM into ScanCode.io
-       uses: aboutcode-org/scancode-action@main
+       uses: aboutcode-org/scancode-action@8adbf888f487c3cdf6c15386035769cd03a94c66
        with:
          pipelines: "load_sbom"
          inputs-path: "bom.cyclonedx.xml"
@@ -203,12 +205,12 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Download ORT SPDX JSON SBOM for mime-types 2.1.26
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3  # v8.0.0
         with:
           name: npm-mime-types-2.1.26-ort-sboms
 
       - name: Import SBOM into ScanCode.io
-        uses: aboutcode-org/scancode-action@main
+        uses: aboutcode-org/scancode-action@8adbf888f487c3cdf6c15386035769cd03a94c66
         with:
           pipelines: "load_sbom"
           inputs-path: "bom.spdx.json"
@@ -229,12 +231,12 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Download ORT SPDX YAML SBOM for mime-types 2.1.26
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3  # v8.0.0
         with:
           name: npm-mime-types-2.1.26-ort-sboms
 
       - name: Import SBOM into ScanCode.io
-        uses: aboutcode-org/scancode-action@main
+        uses: aboutcode-org/scancode-action@8adbf888f487c3cdf6c15386035769cd03a94c66
         with:
           pipelines: "load_sbom"
           inputs-path: "bom.spdx.yml"
diff --git a/.github/workflows/sca-integration-osv-scanner.yml b/.github/workflows/sca-integration-osv-scanner.yml
index 0edaa49d9c..2bc594026f 100644
--- a/.github/workflows/sca-integration-osv-scanner.yml
+++ b/.github/workflows/sca-integration-osv-scanner.yml
@@ -19,6 +19,7 @@ permissions:
 
 env:
   IMAGE_REFERENCE: "python:3.13.0-slim"
+  OSV_SCANNER_URL: "https://github.com/google/osv-scanner/releases/download/v2.3.3/osv-scanner_linux_amd64"
   EXPECTED_PACKAGE: 100
   EXPECTED_VULNERABLE_PACKAGE: 0
   EXPECTED_DEPENDENCY: 90
@@ -29,7 +30,7 @@ jobs:
     steps:
       - name: Install OSV-Scanner
         run: |
-          curl -sLO https://github.com/google/osv-scanner/releases/latest/download/osv-scanner_linux_amd64
+          curl -sLO "$OSV_SCANNER_URL"
           chmod +x osv-scanner_linux_amd64
           sudo mv osv-scanner_linux_amd64 /usr/local/bin/osv-scanner
 
@@ -43,14 +44,14 @@ jobs:
             || true
 
       - name: Upload SBOM as GitHub Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
         with:
           name: osv-scanner-sbom-report
           path: osv-sbom.spdx.json
           retention-days: 20
 
       - name: Import SBOM into ScanCode.io
-        uses: aboutcode-org/scancode-action@main
+        uses: aboutcode-org/scancode-action@8adbf888f487c3cdf6c15386035769cd03a94c66
         with:
           pipelines: "load_sbom"
           inputs-path: "osv-sbom.spdx.json"
diff --git a/.github/workflows/sca-integration-sbom-tool.yml b/.github/workflows/sca-integration-sbom-tool.yml
index 01bc2fe96d..14ef30c99b 100644
--- a/.github/workflows/sca-integration-sbom-tool.yml
+++ b/.github/workflows/sca-integration-sbom-tool.yml
@@ -19,6 +19,7 @@ permissions:
 
 env:
   IMAGE_REFERENCE: "python:3.13.0-slim"
+  SBOM_TOOL_URL: "https://github.com/microsoft/sbom-tool/releases/download/v4.1.5/sbom-tool-linux-x64"
   EXPECTED_PACKAGE: 90
   EXPECTED_VULNERABLE_PACKAGE: 0
   EXPECTED_DEPENDENCY: 90
@@ -29,7 +30,7 @@ jobs:
     steps:
     - name: Download SBOM tool
       run: |
-        curl -Lo $RUNNER_TEMP/sbom-tool https://github.com/microsoft/sbom-tool/releases/latest/download/sbom-tool-linux-x64
+        curl -Lo $RUNNER_TEMP/sbom-tool "$SBOM_TOOL_URL"
         chmod +x $RUNNER_TEMP/sbom-tool
 
     - name: Generate SBOM with SBOM tool
@@ -45,13 +46,13 @@ jobs:
           -V Verbose
 
     - name: Upload SBOM artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
       with:
         name: sbom-output
         path: sbom-output
 
     - name: Import SBOM into ScanCode.io
-      uses: aboutcode-org/scancode-action@main
+      uses: aboutcode-org/scancode-action@8adbf888f487c3cdf6c15386035769cd03a94c66
       with:
         pipelines: "load_sbom"
         inputs-path: "sbom-output/_manifest/spdx_2.2/manifest.spdx.json"
diff --git a/.github/workflows/sca-integration-trivy.yml b/.github/workflows/sca-integration-trivy.yml
index d135e00322..c05e538cce 100644
--- a/.github/workflows/sca-integration-trivy.yml
+++ b/.github/workflows/sca-integration-trivy.yml
@@ -28,24 +28,24 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Generate CycloneDX SBOM with Trivy
-        uses: aquasecurity/trivy-action@0.32.0
+        uses: aquasecurity/trivy-action@57a97c7e7821a5776cebc9bb87c984fa69cba8f1  # v0.35.0
         with:
           scan-type: "image"
           image-ref: ${{ env.IMAGE_REFERENCE }}
           format: "cyclonedx"
           output: "trivy-report.sbom.json"
           scanners: "vuln,license"
-          version: "latest"
+          version: "v0.69.3"
 
       - name: Upload SBOM as GitHub Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f  # v7.0.0
         with:
           name: trivy-sbom-report
           path: "trivy-report.sbom.json"
           retention-days: 20
 
       - name: Import SBOM into ScanCode.io
-        uses: aboutcode-org/scancode-action@main
+        uses: aboutcode-org/scancode-action@8adbf888f487c3cdf6c15386035769cd03a94c66
         with:
           pipelines: "load_sbom"
           inputs-path: "trivy-report.sbom.json"