diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index f89808a4..e26ca462 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -14,10 +14,10 @@ jobs:
     environment: auto-build
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
         with:
           ref: main
-      - uses: actions/setup-java@v3
+      - uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3
         with:
           distribution: 'temurin' 
           java-version: '11'
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index a906c3f1..1c825a70 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -29,22 +29,22 @@ jobs:
           build-mode: none
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
     - name: Setup Java
-      uses: actions/setup-java@v3
+      uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3
       with:
         distribution: 'temurin' 
         java-version: '11'
         cache: 'maven'
 
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
+      uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4
       with:
         languages: ${{ matrix.language }}
         build-mode: ${{ matrix.build-mode }}
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4
       with:
         category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/cred-scan.yml b/.github/workflows/cred-scan.yml
index 8b8a6f96..56194911 100644
--- a/.github/workflows/cred-scan.yml
+++ b/.github/workflows/cred-scan.yml
@@ -11,7 +11,7 @@ jobs:
   cred-scan:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
     - name: Scan credentials
       uses: outscale/cred-scan@main
       with:
diff --git a/.github/workflows/github-sanity-scan.yml b/.github/workflows/github-sanity-scan.yml
index 5df1fb9b..1ba729ac 100644
--- a/.github/workflows/github-sanity-scan.yml
+++ b/.github/workflows/github-sanity-scan.yml
@@ -11,7 +11,7 @@ jobs:
   github-sanity-scan:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v5
+    - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
     - name: Github sanity scanner
       uses: outscale/github-sanity-scan@main
       with:
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 8090213e..51e8fc7b 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -12,8 +12,8 @@ jobs:
     environment: publish
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@v5
-    - uses: actions/setup-java@v3
+    - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+    - uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3
       with:
         distribution: 'temurin' 
         java-version: '11'
diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
index 4518bfcf..c691a769 100644
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@@ -12,15 +12,15 @@ jobs:
   reuse-test:
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
       - name: Reuse specification test
         run: make reuse-test
   examples-test:
     environment: eu-west-2
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/setup-java@v3
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+      - uses: actions/setup-java@17f84c3641ba7b8f6deff6309fc4c864478f5d62 # v3
         with:
           distribution: 'temurin' 
           java-version: '11'
@@ -42,7 +42,7 @@ jobs:
     steps:
       - name: Dependabot metadata
         id: metadata
-        uses: dependabot/fetch-metadata@v1.1.1
+        uses: dependabot/fetch-metadata@a3e5f86ae9f2f49b441498973ddec20035d326b8 # v1.1.1
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
       - name: Auto-merge