diff --git a/.github/workflows/block-merge-label-check.yml b/.github/workflows/block-merge-label-check.yml
index ccb028a46f..c43c45a7df 100644
--- a/.github/workflows/block-merge-label-check.yml
+++ b/.github/workflows/block-merge-label-check.yml
@@ -11,7 +11,7 @@ jobs:
     
     steps:
       - name: Check for Do Not Merge label
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const prNumber = context.payload.pull_request.number;
diff --git a/.github/workflows/deployDocs.yml b/.github/workflows/deployDocs.yml
index c2ec9be4a5..e20809bab5 100644
--- a/.github/workflows/deployDocs.yml
+++ b/.github/workflows/deployDocs.yml
@@ -14,16 +14,16 @@ jobs:
     
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version-file: '.nvmrc'
           cache: 'yarn'
 
       - name: Install dependencies
-        run: yarn install
+        run: NPQ_PKG_MGR=yarn npx npq install --immutable
 
       - name: Build documentation
         run: yarn docs:build
@@ -38,7 +38,7 @@ jobs:
           git config --global user.email "github-actions[bot]@users.noreply.github.com"
           git config --global user.name "github-actions[bot]"
           cd docuilib
-          yarn install
+          NPQ_PKG_MGR=yarn npx npq install --immutable
           yarn deploy
 
       - name: Deploy disclaimer
diff --git a/.github/workflows/label-waiting-for-response.yml b/.github/workflows/label-waiting-for-response.yml
index 825bfec6f8..1786b4b44d 100644
--- a/.github/workflows/label-waiting-for-response.yml
+++ b/.github/workflows/label-waiting-for-response.yml
@@ -21,7 +21,7 @@ jobs:
     steps:
       - name: Check if commenter is maintainer
         id: check-maintainer
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const response = await github.rest.repos.getCollaboratorPermissionLevel({
@@ -35,7 +35,7 @@ jobs:
             
       - name: Add waiting-for-response label
         if: steps.check-maintainer.outputs.result == 'true'
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             await github.rest.issues.addLabels({
@@ -53,7 +53,7 @@ jobs:
     
     steps:
       - name: Process all open issues
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             async function isMaintianer(username) {
diff --git a/.github/workflows/pr-description-check.yml b/.github/workflows/pr-description-check.yml
index 6c0cb7171f..0ec963b4bd 100644
--- a/.github/workflows/pr-description-check.yml
+++ b/.github/workflows/pr-description-check.yml
@@ -11,7 +11,7 @@ jobs:
     
     steps:
       - name: Validate PR Description
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const prBody = context.payload.pull_request.body || '';