diff --git a/.github/workflows/welcome.yml b/.github/workflows/welcome.yml
index b8a44ab..57ee41c 100644
--- a/.github/workflows/welcome.yml
+++ b/.github/workflows/welcome.yml
@@ -20,8 +20,8 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Welcome first-time contributors
-        uses: actions/first-interaction@v3
+        uses: actions/first-interaction@1c4688942c71f71d4f5502a26ea67c331730fa4d # v3
         with:
-          repo-token: ${{ secrets.GITHUB_TOKEN }}
-          issue-message: 'Welcome to **UniversalInvoiceMail**! Thank you for opening your first issue. Our maintainers review incoming issues within the documented SLA.'
-          pr-message: 'Welcome to **UniversalInvoiceMail**! Thank you for opening your first pull request. Please ensure all tests pass and your changes adhere to local-first privacy invariants.'
+          repo_token: ${{ secrets.GITHUB_TOKEN }}
+          issue_message: 'Welcome to **UniversalInvoiceMail**! Thank you for opening your first issue. Our maintainers review incoming issues within the documented SLA.'
+          pr_message: 'Welcome to **UniversalInvoiceMail**! Thank you for opening your first pull request. Please ensure all tests pass and your changes adhere to local-first privacy invariants.'
diff --git a/tests/test_metadata.py b/tests/test_metadata.py
index fd11226..1a53f0b 100644
--- a/tests/test_metadata.py
+++ b/tests/test_metadata.py
@@ -174,7 +174,11 @@ def test_ci_workflow_hardening_contracts():
     welcome_file = workflows_dir / "welcome.yml"
     assert welcome_file.is_file(), "welcome.yml must exist"
     welcome_text = welcome_file.read_text(encoding="utf-8")
-    assert "actions/first-interaction@v3" in welcome_text
+    assert re.search(r"uses:\s+actions/first-interaction@[0-9a-f]{40}(?:\s|$)", welcome_text)
+    welcome_inputs = welcome_text.split("        with:", 1)[1]
+    assert set(re.findall(r"^\s{10}([a-z_-]+):", welcome_inputs, re.MULTILINE)) == {
+        "repo_token", "issue_message", "pr_message"
+    }
     assert "timeout-minutes: 5" in welcome_text
     assert "cancel-in-progress: true" in welcome_text