diff --git a/.github/actions/setup-foundry/action.yml b/.github/actions/setup-foundry/action.yml
index e41c992847..c21e5f845a 100644
--- a/.github/actions/setup-foundry/action.yml
+++ b/.github/actions/setup-foundry/action.yml
@@ -47,7 +47,7 @@ runs:
 
     - name: Download generated Yul
       if: inputs.download-yul == 'true' && steps.local-restore-yul.outcome != 'success'
-      uses: actions/download-artifact@v7
+      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
       with:
         name: ${{ inputs.yul-artifact-name }}
         path: ${{ inputs.yul-artifact-path }}
@@ -102,7 +102,7 @@ runs:
 
     - name: Download difftest interpreter
       if: steps.local-restore-difftest.outcome != 'success'
-      uses: actions/download-artifact@v7
+      uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
       with:
         name: difftest-interpreter
         path: .lake/build/bin
@@ -131,7 +131,7 @@ runs:
 
     - name: Cache Foundry binaries
       id: cache-foundry
-      uses: actions/cache@v5
+      uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
       with:
         path: ~/.foundry/bin
         key: foundry-v1.5.0-linux-amd64
@@ -140,7 +140,7 @@ runs:
       if: steps.cache-foundry.outputs.cache-hit != 'true'
       id: install_foundry_primary
       continue-on-error: true
-      uses: foundry-rs/foundry-toolchain@v1
+      uses: foundry-rs/foundry-toolchain@908c540300062bd5a7e473851cdb4282204cee09 # v1
       with:
         version: v1.5.0
 
diff --git a/.github/actions/setup-lean/action.yml b/.github/actions/setup-lean/action.yml
index d093a555fd..16b168bac4 100644
--- a/.github/actions/setup-lean/action.yml
+++ b/.github/actions/setup-lean/action.yml
@@ -92,7 +92,7 @@ runs:
     - name: Cache elan + Lean toolchain
       id: cache-elan
       if: steps.persistence.outputs.use_sticky_disks != 'true'
-      uses: actions/cache@v5
+      uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
       with:
         path: ~/.elan
         key: elan-${{ hashFiles('lean-toolchain') }}
@@ -179,7 +179,7 @@ runs:
     - name: Restore Lake packages cache
       id: cache-lake
       if: steps.persistence.outputs.use_sticky_disks != 'true' && inputs.disable-lake-cache-restore != 'true'
-      uses: actions/cache/restore@v5
+      uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
       with:
         path: .lake
         key: ${{ steps.resolve-cache-keys.outputs.primary }}
diff --git a/.github/actions/setup-solc/action.yml b/.github/actions/setup-solc/action.yml
index 81dfc668ce..d125d4d7a4 100644
--- a/.github/actions/setup-solc/action.yml
+++ b/.github/actions/setup-solc/action.yml
@@ -12,7 +12,7 @@ runs:
   steps:
     - name: Cache solc binary
       id: cache-solc
-      uses: actions/cache@v5
+      uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5
       with:
         path: .cache/solc/${{ env.SOLC_VERSION }}
         key: solc-${{ env.SOLC_VERSION }}
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 63ad8dd968..815eb5ad66 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -27,7 +27,7 @@ jobs:
       run:
         working-directory: docs-site
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
 
@@ -45,7 +45,7 @@ jobs:
             echo "Skipping build: newer commit detected (${latest_sha})."
           fi
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         if: github.event_name != 'push' || steps.freshness.outputs.should_build == 'true'
         with:
           node-version: 22
diff --git a/.github/workflows/evmyullean-fork-conformance.yml b/.github/workflows/evmyullean-fork-conformance.yml
index ffac300aeb..a945257fe3 100644
--- a/.github/workflows/evmyullean-fork-conformance.yml
+++ b/.github/workflows/evmyullean-fork-conformance.yml
@@ -72,7 +72,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           submodules: recursive
 
@@ -103,7 +103,7 @@ jobs:
       issues: write
     steps:
       - name: Open or update drift issue
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             const marker = "<!-- evmyullean-fork-conformance-failure -->";
diff --git a/.github/workflows/issue-intake-guard.yml b/.github/workflows/issue-intake-guard.yml
index daff80ce2d..99f1833f58 100644
--- a/.github/workflows/issue-intake-guard.yml
+++ b/.github/workflows/issue-intake-guard.yml
@@ -12,7 +12,7 @@ jobs:
   validate-intake:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Validate issue submission
         id: validate
@@ -37,7 +37,7 @@ jobs:
 
       - name: Comment and close invalid issue
         if: steps.validate.outputs.status != '0'
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         env:
           FINDINGS: ${{ steps.validate.outputs.findings }}
         with:
diff --git a/.github/workflows/ocr-review.yml b/.github/workflows/ocr-review.yml
index 96c93b9368..5531d424e1 100644
--- a/.github/workflows/ocr-review.yml
+++ b/.github/workflows/ocr-review.yml
@@ -41,7 +41,7 @@ jobs:
     steps:
       - name: Resolve PR context
         id: pr
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             let pr;
@@ -79,7 +79,7 @@ jobs:
 
       - name: Checkout trusted OCR tooling
         if: steps.pr.outputs.skip != 'true'
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           ref: ${{ github.event.repository.default_branch }}
           path: ocr-trusted
@@ -87,7 +87,7 @@ jobs:
 
       - name: Checkout PR head
         if: steps.pr.outputs.skip != 'true'
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
           ref: ${{ steps.pr.outputs.head_sha }}
@@ -110,7 +110,7 @@ jobs:
 
       - name: Setup Node.js
         if: steps.pr.outputs.skip != 'true'
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: '22'
 
@@ -264,7 +264,7 @@ jobs:
 
       - name: Post OCR review
         if: steps.pr.outputs.skip != 'true' && always() && !cancelled() && steps.route.outcome == 'success' && (steps.route.outputs.should_run_ocr != 'true' || steps.ocr.outcome == 'success')
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         env:
           OCR_RESULT_PATH: ${{ runner.temp }}/ocr-result.json
           OCR_STDERR_PATH: ${{ runner.temp }}/ocr-stderr.log
@@ -283,7 +283,7 @@ jobs:
 
       - name: Upload OCR metrics
         if: steps.pr.outputs.skip != 'true' && always() && !cancelled() && steps.route.outcome == 'success' && (steps.route.outputs.should_run_ocr != 'true' || steps.ocr.outcome == 'success')
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: ocr-metrics-${{ steps.pr.outputs.number }}-${{ steps.pr.outputs.head_sha }}
           path: ${{ runner.temp }}/ocr-metrics.json
diff --git a/.github/workflows/runner-benchmark.yml b/.github/workflows/runner-benchmark.yml
index 04ccdaba1e..911e8f91e3 100644
--- a/.github/workflows/runner-benchmark.yml
+++ b/.github/workflows/runner-benchmark.yml
@@ -70,7 +70,7 @@ jobs:
             uptime
           } | tee -a "$GITHUB_STEP_SUMMARY"
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           submodules: recursive
 
@@ -140,7 +140,7 @@ jobs:
 
       - name: Upload benchmark log
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: runner-benchmark-${{ inputs.task }}-${{ runner.arch }}-${{ github.run_id }}
           path: benchmark.log
diff --git a/.github/workflows/runner-lean-validation.yml b/.github/workflows/runner-lean-validation.yml
index f73c4cbd42..68e7c0c7ce 100644
--- a/.github/workflows/runner-lean-validation.yml
+++ b/.github/workflows/runner-lean-validation.yml
@@ -73,7 +73,7 @@ jobs:
             uptime
           } | tee -a "$GITHUB_STEP_SUMMARY"
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           submodules: recursive
 
@@ -256,7 +256,7 @@ jobs:
 
       - name: Upload validation logs
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: runner-lean-validation-${{ runner.arch }}-${{ github.run_id }}
           path: |
diff --git a/.github/workflows/verify.yml b/.github/workflows/verify.yml
index 6d2b5325c1..9227f7604a 100644
--- a/.github/workflows/verify.yml
+++ b/.github/workflows/verify.yml
@@ -116,7 +116,7 @@ jobs:
       # branches, close dependents, or drop artifacts while the closed PR/branch
       # is a stack member/base or has open dependent PRs. Uses Stacks REST API
       # plus a direct open-PR base-ref fallback (beta/API lag safe).
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           # Never execute a guard supplied or modified by the closing PR.
           ref: ${{ github.event.pull_request.base.sha }}
@@ -195,9 +195,9 @@ jobs:
       build: ${{ steps.effective.outputs.build }}
       compiler: ${{ steps.effective.outputs.compiler }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
-      - uses: dorny/paths-filter@v4
+      - uses: dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d # v4
         id: filter
         with:
           filters: |
@@ -310,7 +310,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           repository: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name || github.repository }}
           ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.ref || '' }}
@@ -357,7 +357,7 @@ jobs:
       actions: read
       contents: read
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           path: watchdog-${{ github.run_id }}-${{ github.run_attempt }}
 
@@ -381,7 +381,7 @@ jobs:
     env:
       LEAN_NUM_THREADS: 8
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           submodules: recursive
 
@@ -444,7 +444,7 @@ jobs:
       # The differential controls execute EVM bytecode via forge in this job,
       # before the downstream Foundry jobs can provision their own toolchains.
       - name: Setup Foundry for Solidity differential controls
-        uses: foundry-rs/foundry-toolchain@v1
+        uses: foundry-rs/foundry-toolchain@908c540300062bd5a7e473851cdb4282204cee09 # v1
         with:
           version: v1.5.0
 
@@ -468,21 +468,21 @@ jobs:
             --path lean-workspace-build.tar
 
       - name: Upload prepared Lean workspace build
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: lean-workspace-build
           path: lean-workspace-build.tar
 
       - name: Save current run Lake cache
         if: success() && needs.changes.outputs.build == 'true' && steps.setup-lean.outputs.using-sticky-disks != 'true'
-        uses: actions/cache/save@v5
+        uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5
         with:
           path: .lake
           key: lake-${{ runner.os }}-${{ hashFiles('lean-toolchain') }}-${{ hashFiles('lakefile.lean') }}-${{ hashFiles('lake-manifest.json') }}-${{ github.run_id }}
 
       - name: Save Lake packages cache
         if: success() && needs.changes.outputs.build == 'true' && steps.setup-lean.outputs.using-sticky-disks != 'true' && steps.setup-lean.outputs.cache-hit != 'true'
-        uses: actions/cache/save@v5
+        uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5
         with:
           path: .lake
           key: lake-${{ runner.os }}-${{ hashFiles('lean-toolchain') }}-${{ hashFiles('lakefile.lean') }}-${{ hashFiles('lake-manifest.json') }}
@@ -496,7 +496,7 @@ jobs:
     env:
       LEAN_NUM_THREADS: 4
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           submodules: recursive
 
@@ -522,7 +522,7 @@ jobs:
 
       - name: Download prepared Lean workspace build
         if: steps.local-restore-lean-workspace.outcome != 'success'
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           name: lean-workspace-build
 
@@ -555,7 +555,7 @@ jobs:
         run: python3 scripts/check_storage_layout.py --format=markdown >> $GITHUB_STEP_SUMMARY
 
       - name: Upload axiom dependency report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: axiom-dependency-report
           path: |
@@ -577,7 +577,7 @@ jobs:
       CCACHE_COMPILERCHECK: content
       CCACHE_MAXSIZE: 2G
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           submodules: recursive
 
@@ -628,7 +628,7 @@ jobs:
 
       - name: Restore compiler ccache fallback cache
         if: env.VERIFY_CLEAN_BUILD != 'true'
-        uses: actions/cache/restore@v5
+        uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
         with:
           path: ${{ runner.temp }}/compiler-ccache-cache
           key: compiler-ccache-cache-${{ env.VERIFY_CACHE_BUCKET }}-${{ runner.os }}-${{ hashFiles('lean-toolchain') }}-${{ hashFiles('lakefile.lean') }}-${{ hashFiles('lake-manifest.json') }}-${{ github.run_id }}
@@ -667,7 +667,7 @@ jobs:
 
       - name: Download prepared Lean workspace build
         if: steps.local-restore-lean-workspace.outcome != 'success'
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           name: lean-workspace-build
 
@@ -740,7 +740,7 @@ jobs:
       - name: Save compiler ccache fallback cache
         if: always() && (failure() || steps.setup-lean.outputs.using-sticky-disks != 'true')
         continue-on-error: true
-        uses: actions/cache/save@v5
+        uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5
         with:
           path: ${{ github.workspace }}/.cache/ccache
           key: compiler-ccache-cache-${{ env.VERIFY_CACHE_BUCKET }}-${{ runner.os }}-${{ hashFiles('lean-toolchain') }}-${{ hashFiles('lakefile.lean') }}-${{ hashFiles('lake-manifest.json') }}-${{ github.run_id }}
@@ -918,14 +918,14 @@ jobs:
 
       - name: Upload difftest interpreter
         if: '!cancelled()'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: difftest-interpreter
           path: .lake/build/bin/difftest-interpreter
 
       - name: Upload compiler binaries
         if: '!cancelled()'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: verity-compiler-binaries
           path: compiler/bin
@@ -933,7 +933,7 @@ jobs:
 
       - name: Upload compiler workspace build
         if: '!cancelled()'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: lean-workspace-compiler-build
           path: lean-workspace-compiler-build.tar
@@ -941,49 +941,49 @@ jobs:
 
       - name: Upload generated Yul
         if: '!cancelled()'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: generated-yul
           path: compiler/yul
 
       - name: Upload patched Yul
         if: '!cancelled()'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: generated-yul-patched
           path: compiler/yul-patched
 
       - name: Upload smoke Yul
         if: '!cancelled()'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: generated-yul-smoke
           path: compiler/yul-smoke
 
       - name: Upload patched smoke Yul
         if: '!cancelled()'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: generated-yul-patched-smoke
           path: compiler/yul-patched-smoke
 
       - name: Upload patch coverage report
         if: '!cancelled()'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: patch-coverage-report
           path: compiler/patch-report.tsv
 
       - name: Upload static gas report
         if: '!cancelled()'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: static-gas-report
           path: gas-report-static.tsv
 
       - name: Upload patched static gas report
         if: '!cancelled()'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: static-gas-report-patched
           path: gas-report-static-patched.tsv
@@ -994,7 +994,7 @@ jobs:
     needs: [changes, checks, build, build-compiler-binaries]
     if: needs.checks.result == 'success' && needs.build.result == 'success' && needs.build-compiler-binaries.result == 'success' && needs.changes.outputs.compiler == 'true'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           submodules: recursive
 
@@ -1022,7 +1022,7 @@ jobs:
 
       - name: Download prepared Lean workspace build
         if: steps.local-restore-lean-workspace.outcome != 'success'
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           name: lean-workspace-build
 
@@ -1041,7 +1041,7 @@ jobs:
 
       - name: Download compiler workspace build
         if: steps.local-restore-compiler-workspace.outcome != 'success'
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           name: lean-workspace-compiler-build
 
@@ -1064,7 +1064,7 @@ jobs:
 
       - name: Download generated Yul (fallback)
         if: steps.local-restore-yul.outcome != 'success'
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           name: generated-yul
           path: compiler/yul
@@ -1084,23 +1084,23 @@ jobs:
 
       - name: Download patched Yul (fallback)
         if: steps.local-restore-yul-patched.outcome != 'success'
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           name: generated-yul-patched
           path: compiler/yul-patched
 
       - name: Download static gas report
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           name: static-gas-report
 
       - name: Download patched static gas report
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           name: static-gas-report-patched
 
       - name: Download patch coverage report
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           name: patch-coverage-report
           path: compiler
@@ -1120,7 +1120,7 @@ jobs:
 
       - name: Download compiler binaries
         if: steps.local-restore-compiler-binaries.outcome != 'success'
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           name: verity-compiler-binaries
           path: compiler/bin
@@ -1203,7 +1203,7 @@ jobs:
     env:
       LEAN_NUM_THREADS: 4
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           submodules: recursive
 
@@ -1231,7 +1231,7 @@ jobs:
 
       - name: Download prepared Lean workspace build
         if: steps.local-restore-lean-workspace.outcome != 'success'
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           name: lean-workspace-build
 
@@ -1250,7 +1250,7 @@ jobs:
 
       - name: Download compiler workspace build
         if: steps.local-restore-compiler-workspace.outcome != 'success'
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           name: lean-workspace-compiler-build
 
@@ -1259,7 +1259,7 @@ jobs:
         run: tar -xf lean-workspace-compiler-build.tar
 
       - name: Install Foundry for Solidity slice comparisons
-        uses: foundry-rs/foundry-toolchain@v1
+        uses: foundry-rs/foundry-toolchain@908c540300062bd5a7e473851cdb4282204cee09 # v1
         with:
           version: v1.5.0
 
@@ -1285,7 +1285,7 @@ jobs:
 
       - name: Archive Solidity slice comparison evidence
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: solidity-import-differential
           path: |
@@ -1316,7 +1316,7 @@ jobs:
       - name: Archive Solidity import coverage
         if: always()
         continue-on-error: true
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: solidity-import-coverage
           path: .lake/solidity-import-coverage/**
@@ -1356,7 +1356,7 @@ jobs:
     continue-on-error: true
     if: github.event_name == 'workflow_dispatch' && inputs.lean_profile && needs.changes.outputs.build == 'true' && needs.build.result == 'success'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
 
       - name: Setup Lean
         uses: ./.github/actions/setup-lean
@@ -1374,7 +1374,7 @@ jobs:
         run: cat lean-perf-queue.md >> "$GITHUB_STEP_SUMMARY"
 
       - name: Upload Lean perf queue
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7
         with:
           name: lean-perf-queue
           path: lean-perf-queue.md
@@ -1385,12 +1385,12 @@ jobs:
     needs: [changes, build-compiler-binaries]
     if: needs.changes.outputs.compiler == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.draft == false)
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           submodules: recursive
 
       - name: Download static gas report
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           name: static-gas-report
 
@@ -1447,7 +1447,7 @@ jobs:
       matrix:
         shard_index: [0, 1, 2, 3]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           submodules: recursive
 
@@ -1466,7 +1466,7 @@ jobs:
 
       - name: Download compiler binaries
         if: steps.local-restore-compiler-binaries.outcome != 'success'
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           name: verity-compiler-binaries
           path: compiler/bin
@@ -1496,7 +1496,7 @@ jobs:
 
       - name: Download smoke Yul (fallback)
         if: steps.local-restore-yul-smoke.outcome != 'success'
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           name: generated-yul-smoke
           path: compiler/yul-smoke
@@ -1556,7 +1556,7 @@ jobs:
     needs: [changes, build-compiler-binaries]
     if: needs.changes.outputs.compiler == 'true' && (github.event_name != 'pull_request' || github.event.pull_request.draft == false)
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           submodules: recursive
 
@@ -1571,7 +1571,7 @@ jobs:
 
       - name: Download prepared Lean workspace build
         if: steps.local-restore-lean-workspace.outcome != 'success'
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           name: lean-workspace-build
 
@@ -1590,7 +1590,7 @@ jobs:
 
       - name: Download compiler workspace build
         if: steps.local-restore-compiler-workspace.outcome != 'success'
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           name: lean-workspace-compiler-build
 
@@ -1620,7 +1620,7 @@ jobs:
 
       - name: Download patched smoke Yul (fallback)
         if: steps.local-restore-yul-patched-smoke.outcome != 'success'
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           name: generated-yul-patched-smoke
           path: compiler/yul-patched-smoke
@@ -1687,7 +1687,7 @@ jobs:
       matrix:
         seed: [0, 1, 42, 123, 999, 12345, 67890]
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
           submodules: recursive
 
@@ -1706,7 +1706,7 @@ jobs:
 
       - name: Download compiler binaries
         if: steps.local-restore-compiler-binaries.outcome != 'success'
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           name: verity-compiler-binaries
           path: compiler/bin
@@ -1736,7 +1736,7 @@ jobs:
 
       - name: Download smoke Yul (fallback)
         if: steps.local-restore-yul-smoke.outcome != 'success'
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7
         with:
           name: generated-yul-smoke
           path: compiler/yul-smoke
@@ -1808,7 +1808,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Post CI failure hints
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         env:
           NEEDS_JSON: ${{ toJson(needs) }}
         with:
diff --git a/docs/AXIOMS.md b/docs/AXIOMS.md
index a7fc688c29..f745e53a7d 100644
--- a/docs/AXIOMS.md
+++ b/docs/AXIOMS.md
@@ -20,6 +20,11 @@ Axioms are exceptional. When an axiom exists, it must have:
 3. CI checks that validate usage assumptions.
 4. A clear elimination path, when practical.
 
+CI itself is an operational trust boundary rather than a Lean axiom. External
+GitHub Actions are full-SHA pinned and repository policy rejects mutable Action
+references; see `TRUST_ASSUMPTIONS.md` under “CI execution and Action supply
+chain.”
+
 ## Current Axioms
 
 - Active axioms: 1
diff --git a/docs/TRUST_ASSUMPTIONS.md b/docs/TRUST_ASSUMPTIONS.md
index 2c27026af8..bcf21a3a27 100644
--- a/docs/TRUST_ASSUMPTIONS.md
+++ b/docs/TRUST_ASSUMPTIONS.md
@@ -145,6 +145,21 @@ is not part of this change. Solidity sources are Lake inputs only when the
 consumer declares them (`input_dir` + `needs`); consumers should also
 re-elaborate in CI to verify freshness against a compiled import.
 
+## CI execution and Action supply chain
+
+GitHub Actions and the machines that execute them are operational trust
+boundaries, not part of the Lean proof kernel. Every external Action reference
+under `.github/` is pinned to a full commit SHA; local composite Actions remain
+reviewed repository code. Repository policy rejects mutable external Action
+tags, gives workflows read-only default token permissions, and requires manual
+approval before workflows from every external fork contributor may run.
+
+Self-hosted runners remain trusted infrastructure. Pull-request code is
+untrusted even after approval and must not share credentials, writable data, or
+network reachability with production services. These controls reduce Action
+supply-chain drift and accidental execution; they do not make a persistent
+self-hosted runner a security boundary.
+
 ## Compilation Pipeline
 
 ```
diff --git a/scripts/check_verify_sync.py b/scripts/check_verify_sync.py
index cf08e29eee..d7935ae4a9 100755
--- a/scripts/check_verify_sync.py
+++ b/scripts/check_verify_sync.py
@@ -657,7 +657,12 @@ def _step_uses_action(step_block: str, action: str) -> bool:
     if uses_value is None:
         return False
     uses_clean = unquote_yaml_scalar(strip_yaml_inline_comment(uses_value))
-    return bool(re.fullmatch(rf"actions/{re.escape(action)}@v\d+", uses_clean))
+    return bool(
+        re.fullmatch(
+            rf"actions/{re.escape(action)}@(?:v\d+|[0-9a-fA-F]{{40}})",
+            uses_clean,
+        )
+    )
 
 
 def _extract_artifact_names(job_body: str, *, action: str) -> list[str]:
diff --git a/scripts/test_check_issue_templates.py b/scripts/test_check_issue_templates.py
index c3874e2a20..a2adf36347 100644
--- a/scripts/test_check_issue_templates.py
+++ b/scripts/test_check_issue_templates.py
@@ -163,7 +163,7 @@ def test_check_issue_templates_scans_config_yaml_for_contamination(self) -> None
             encoding="utf-8",
         )
         (self.templates / "config.yaml").write_text(
-            "blank_issues_enabled: false\n##[group]Run actions/checkout@v4\n",
+            "blank_issues_enabled: false\n##[group]Run actions/checkout@11d5960a326750d5838078e36cf38b85af677262\n",
             encoding="utf-8",
         )
 
@@ -187,7 +187,7 @@ def test_main_fails_on_contaminated_template(self) -> None:
 body:
   - type: markdown
     attributes:
-      value: "##[group]Run actions/checkout@v4"
+      value: "##[group]Run actions/checkout@11d5960a326750d5838078e36cf38b85af677262"
 """.strip()
             + "\n",
             encoding="utf-8",
diff --git a/scripts/test_check_verify_sync.py b/scripts/test_check_verify_sync.py
index 7b38263aec..161ad1e352 100644
--- a/scripts/test_check_verify_sync.py
+++ b/scripts/test_check_verify_sync.py
@@ -426,7 +426,7 @@ def test_paths_check_fails_when_push_branch_and_workflow_dispatch_drift(self) ->
               changes:
                 runs-on: ubuntu-latest
                 steps:
-                  - uses: actions/checkout@v4
+                  - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
                   - id: filter
                     uses: dorny/paths-filter@v3
                     with:
@@ -471,7 +471,7 @@ def test_paths_check_fails_when_extra_trigger_is_added(self) -> None:
               changes:
                 runs-on: ubuntu-latest
                 steps:
-                  - uses: actions/checkout@v4
+                  - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
                   - id: filter
                     uses: dorny/paths-filter@v3
                     with:
@@ -513,7 +513,7 @@ def test_paths_check_passes_when_trigger_contracts_match_spec(self) -> None:
               changes:
                 runs-on: ubuntu-latest
                 steps:
-                  - uses: actions/checkout@v4
+                  - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
                   - id: filter
                     uses: dorny/paths-filter@v3
                     with:
@@ -880,19 +880,19 @@ def test_step_contracts_check_fails_when_action_config_drifts(self) -> None:
               changes:
                 runs-on: ubuntu-latest
                 steps:
-                  - uses: actions/checkout@v4
+                  - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
                   - id: changed-filter
                     uses: dorny/paths-filter@v3
               checks:
                 runs-on: ubuntu-latest
                 steps:
-                  - uses: actions/checkout@v4
+                  - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
                   - name: Run all checks
                     run: make verify
               build:
                 runs-on: ubuntu-latest
                 steps:
-                  - uses: actions/checkout@v4
+                  - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
                     with:
                       submodules: false
                   - name: Setup Lean
@@ -909,7 +909,7 @@ def test_step_contracts_check_fails_when_action_config_drifts(self) -> None:
                 runs-on: ubuntu-latest
                 steps:
                   - name: Post CI failure hints
-                    uses: actions/github-script@v7
+                    uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b
                     env:
                       NEEDS_JSON: stale
                     with:
@@ -922,7 +922,7 @@ def test_step_contracts_check_fails_when_action_config_drifts(self) -> None:
             expected_step_contracts={
                 "changes": [
                     {
-                        "uses": "actions/checkout@v4",
+                        "uses": "actions/checkout@11d5960a326750d5838078e36cf38b85af677262",
                     },
                     {
                         "id": "filter",
@@ -931,7 +931,7 @@ def test_step_contracts_check_fails_when_action_config_drifts(self) -> None:
                 ],
                 "checks": [
                     {
-                        "uses": "actions/checkout@v4",
+                        "uses": "actions/checkout@11d5960a326750d5838078e36cf38b85af677262",
                     },
                     {
                         "name": "Run all checks",
@@ -940,7 +940,7 @@ def test_step_contracts_check_fails_when_action_config_drifts(self) -> None:
                 ],
                 "build": [
                     {
-                        "uses": "actions/checkout@v4",
+                        "uses": "actions/checkout@11d5960a326750d5838078e36cf38b85af677262",
                         "with": {"submodules": "recursive"},
                     },
                     {
@@ -964,7 +964,7 @@ def test_step_contracts_check_fails_when_action_config_drifts(self) -> None:
                 "failure-hints": [
                     {
                         "name": "Post CI failure hints",
-                        "uses": "actions/github-script@v7",
+                        "uses": "actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b",
                         "env": {"NEEDS_JSON": "${{ toJson(needs) }}"},
                         "with": {"script": FAILURE_HINTS_SCRIPT},
                     }
@@ -990,11 +990,11 @@ def test_step_contracts_check_fails_when_action_config_drifts(self) -> None:
             err,
         )
         self.assertIn(
-            "failure-hints step name='Post CI failure hints', uses='actions/github-script@v7' has env.NEEDS_JSON='stale', expected '${{ toJson(needs) }}'",
+            "failure-hints step name='Post CI failure hints', uses='actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b' has env.NEEDS_JSON='stale', expected '${{ toJson(needs) }}'",
             err,
         )
         self.assertIn(
-            "failure-hints step name='Post CI failure hints', uses='actions/github-script@v7' has with.script='core.info(\"stale\")', expected",
+            "failure-hints step name='Post CI failure hints', uses='actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b' has with.script='core.info(\"stale\")', expected",
             err,
         )
 
@@ -1006,19 +1006,19 @@ def test_step_contracts_check_passes_when_critical_steps_match_spec(self) -> Non
               changes:
                 runs-on: ubuntu-latest
                 steps:
-                  - uses: actions/checkout@v4
+                  - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
                   - id: filter
                     uses: dorny/paths-filter@v3
               checks:
                 runs-on: ubuntu-latest
                 steps:
-                  - uses: actions/checkout@v4
+                  - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
                   - name: Run all checks
                     run: make check
               build:
                 runs-on: ubuntu-latest
                 steps:
-                  - uses: actions/checkout@v4
+                  - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
                     with:
                       submodules: recursive
                   - name: Setup Lean
@@ -1041,7 +1041,7 @@ def test_step_contracts_check_passes_when_critical_steps_match_spec(self) -> Non
                 runs-on: ubuntu-latest
                 steps:
                   - name: Post CI failure hints
-                    uses: actions/github-script@v7
+                    uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b
                     env:
                       NEEDS_JSON: ${{ toJson(needs) }}
                     with:
@@ -1104,7 +1104,7 @@ def test_step_contracts_check_passes_when_critical_steps_match_spec(self) -> Non
             expected_step_contracts={
                 "changes": [
                     {
-                        "uses": "actions/checkout@v4",
+                        "uses": "actions/checkout@11d5960a326750d5838078e36cf38b85af677262",
                     },
                     {
                         "id": "filter",
@@ -1113,7 +1113,7 @@ def test_step_contracts_check_passes_when_critical_steps_match_spec(self) -> Non
                 ],
                 "checks": [
                     {
-                        "uses": "actions/checkout@v4",
+                        "uses": "actions/checkout@11d5960a326750d5838078e36cf38b85af677262",
                     },
                     {
                         "name": "Run all checks",
@@ -1122,7 +1122,7 @@ def test_step_contracts_check_passes_when_critical_steps_match_spec(self) -> Non
                 ],
                 "build": [
                     {
-                        "uses": "actions/checkout@v4",
+                        "uses": "actions/checkout@11d5960a326750d5838078e36cf38b85af677262",
                         "with": {"submodules": "recursive"},
                     },
                     {
@@ -1146,7 +1146,7 @@ def test_step_contracts_check_passes_when_critical_steps_match_spec(self) -> Non
                 "failure-hints": [
                     {
                         "name": "Post CI failure hints",
-                        "uses": "actions/github-script@v7",
+                        "uses": "actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b",
                         "env": {"NEEDS_JSON": "${{ toJson(needs) }}"},
                         "with": {"script": FAILURE_HINTS_SCRIPT},
                     }
@@ -1165,7 +1165,7 @@ def test_step_contracts_check_folds_with_script_block_scalars(self) -> None:
                 runs-on: ubuntu-latest
                 steps:
                   - name: Post CI failure hints
-                    uses: actions/github-script@v7
+                    uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b
                     with:
                       script: >-
                         const marker = "<!-- ci-failure-hints -->";
@@ -1179,7 +1179,7 @@ def test_step_contracts_check_folds_with_script_block_scalars(self) -> None:
                 "failure-hints": [
                     {
                         "name": "Post CI failure hints",
-                        "uses": "actions/github-script@v7",
+                        "uses": "actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b",
                         "with": {
                             "script": 'const marker = "<!-- ci-failure-hints -->";\ncore.info(marker);'
                         },
@@ -1898,13 +1898,13 @@ def test_artifacts_check_fails_when_expected_upload_is_missing(self) -> None:
           build-audits:
             runs-on: ubuntu-latest
             steps:
-              - uses: actions/upload-artifact@v4
+              - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
                 with:
                   name: axiom-dependency-report
           build-compiler:
             runs-on: ubuntu-latest
             steps:
-              - uses: actions/upload-artifact@v4
+              - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
                 with:
                   name: generated-yul
           foundry:
@@ -1939,7 +1939,7 @@ def test_artifacts_check_fails_when_upload_name_is_empty(self) -> None:
             """
             runs-on: ubuntu-latest
             steps:
-              - uses: actions/upload-artifact@v4
+              - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
                 with:
                   name:
             """
@@ -1956,7 +1956,7 @@ def test_artifacts_check_fails_when_upload_path_drifts(self) -> None:
           build-audits:
             runs-on: ubuntu-latest
             steps:
-              - uses: actions/upload-artifact@v4
+              - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
                 with:
                   name: axiom-dependency-report
                   path: |
@@ -1990,10 +1990,10 @@ def test_artifacts_check_fails_when_expected_download_is_missing(self) -> None:
           build-compiler:
             runs-on: ubuntu-latest
             steps:
-              - uses: actions/upload-artifact@v4
+              - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
                 with:
                   name: static-gas-report
-              - uses: actions/upload-artifact@v4
+              - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
                 with:
                   name: generated-yul
           foundry-gas-calibration:
@@ -2029,7 +2029,7 @@ def test_artifacts_check_fails_when_download_path_drift_removes_destination(self
           build-compiler:
             runs-on: ubuntu-latest
             steps:
-              - uses: actions/upload-artifact@v4
+              - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
                 with:
                   name: generated-yul
                   path: compiler/yul
@@ -2072,7 +2072,7 @@ def test_artifacts_check_passes_when_uploads_and_downloads_match_spec(self) -> N
           build-audits:
             runs-on: ubuntu-latest
             steps:
-              - uses: actions/upload-artifact@v4
+              - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
                 with:
                   name: axiom-dependency-report
                   path: |
@@ -2081,18 +2081,18 @@ def test_artifacts_check_passes_when_uploads_and_downloads_match_spec(self) -> N
           build-compiler:
             runs-on: ubuntu-latest
             steps:
-              - uses: actions/upload-artifact@v4
+              - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
                 with:
                   name: generated-yul
                   path: compiler/yul
-              - uses: actions/upload-artifact@v4
+              - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
                 with:
                   name: static-gas-report
                   path: gas-report-static.tsv
           lean-profile:
             runs-on: ubuntu-latest
             steps:
-              - uses: actions/upload-artifact@v4
+              - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
                 with:
                   name: lean-perf-queue
                   path: lean-perf-queue.md
diff --git a/scripts/test_evmyullean_fork_conformance_workflow.py b/scripts/test_evmyullean_fork_conformance_workflow.py
index 35f6131e79..08edfcc4e4 100644
--- a/scripts/test_evmyullean_fork_conformance_workflow.py
+++ b/scripts/test_evmyullean_fork_conformance_workflow.py
@@ -92,7 +92,7 @@ def test_scheduled_failures_open_or_update_issue(self) -> None:
         self.assertNotIn("github.event_name == 'pull_request'", issue_job_body)
         self.assertNotIn("github.event_name == 'push'", issue_job_body)
         self.assertIn("issues: write", issue_job_body)
-        self.assertIn("uses: actions/github-script@v7", text)
+        self.assertIn("uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b", text)
         self.assertIn("const title = \"EVMYulLean fork conformance probe failed\";", text)
         self.assertIn("github.rest.issues.createComment", text)
         self.assertIn("github.rest.issues.create({", text)
diff --git a/scripts/test_workflow_jobs.py b/scripts/test_workflow_jobs.py
index aac361a0f5..42e35f8be5 100644
--- a/scripts/test_workflow_jobs.py
+++ b/scripts/test_workflow_jobs.py
@@ -68,7 +68,7 @@ def test_extract_literal_from_env_ignores_with_block_decoys(self) -> None:
         body = "\n".join(
             [
                 "    steps:",
-                "      - uses: actions/upload-artifact@v4",
+                "      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02",
                 "        with:",
                 '          DIFFTEST_RANDOM_SEED: "999"',
                 "      - name: run tests",
diff --git a/scripts/verify_sync_spec.json b/scripts/verify_sync_spec.json
index 31cd971016..948df548a7 100644
--- a/scripts/verify_sync_spec.json
+++ b/scripts/verify_sync_spec.json
@@ -281,11 +281,11 @@
   "expected_step_contracts": {
     "changes": [
       {
-        "uses": "actions/checkout@v6"
+        "uses": "actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803"
       },
       {
         "id": "filter",
-        "uses": "dorny/paths-filter@v4"
+        "uses": "dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d"
       },
       {
         "id": "effective",
@@ -301,7 +301,7 @@
     ],
     "checks": [
       {
-        "uses": "actions/checkout@v6",
+        "uses": "actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803",
         "with": {
           "path": "checks-${{ github.run_id }}-${{ github.run_attempt }}"
         }
@@ -317,7 +317,7 @@
     ],
     "timeout-watchdog": [
       {
-        "uses": "actions/checkout@v6",
+        "uses": "actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803",
         "with": {
           "path": "watchdog-${{ github.run_id }}-${{ github.run_attempt }}"
         }
@@ -332,7 +332,7 @@
     ],
     "build": [
       {
-        "uses": "actions/checkout@v6",
+        "uses": "actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803",
         "with": {
           "submodules": "recursive"
         }
@@ -372,7 +372,7 @@
       },
       {
         "name": "Upload prepared Lean workspace build",
-        "uses": "actions/upload-artifact@v7",
+        "uses": "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a",
         "with": {
           "name": "lean-workspace-build",
           "path": "lean-workspace-build.tar"
@@ -380,7 +380,7 @@
       },
       {
         "name": "Save current run Lake cache",
-        "uses": "actions/cache/save@v5",
+        "uses": "actions/cache/save@caa296126883cff596d87d8935842f9db880ef25",
         "if": "success() && needs.changes.outputs.build == 'true' && steps.setup-lean.outputs.using-sticky-disks != 'true'",
         "with": {
           "path": ".lake",
@@ -389,7 +389,7 @@
       },
       {
         "name": "Save Lake packages cache",
-        "uses": "actions/cache/save@v5",
+        "uses": "actions/cache/save@caa296126883cff596d87d8935842f9db880ef25",
         "if": "success() && needs.changes.outputs.build == 'true' && steps.setup-lean.outputs.using-sticky-disks != 'true' && steps.setup-lean.outputs.cache-hit != 'true'",
         "with": {
           "path": ".lake",
@@ -399,7 +399,7 @@
     ],
     "build-audits": [
       {
-        "uses": "actions/checkout@v6",
+        "uses": "actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803",
         "with": {
           "submodules": "recursive"
         }
@@ -422,14 +422,14 @@
       {
         "name": "Download prepared Lean workspace build",
         "if": "steps.local-restore-lean-workspace.outcome != 'success'",
-        "uses": "actions/download-artifact@v7",
+        "uses": "actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131",
         "with": {
           "name": "lean-workspace-build"
         }
       },
       {
         "name": "Upload axiom dependency report",
-        "uses": "actions/upload-artifact@v7",
+        "uses": "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a",
         "with": {
           "name": "axiom-dependency-report",
           "path": "axiom-report.md\naxiom-report-raw.log"
@@ -438,7 +438,7 @@
     ],
     "build-compiler-binaries": [
       {
-        "uses": "actions/checkout@v6",
+        "uses": "actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803",
         "with": {
           "submodules": "recursive"
         }
@@ -446,7 +446,7 @@
       {
         "name": "Restore compiler ccache fallback cache",
         "if": "env.VERIFY_CLEAN_BUILD != 'true'",
-        "uses": "actions/cache/restore@v5",
+        "uses": "actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25",
         "with": {
           "path": "${{ runner.temp }}/compiler-ccache-cache",
           "key": "compiler-ccache-cache-${{ env.VERIFY_CACHE_BUCKET }}-${{ runner.os }}-${{ hashFiles('lean-toolchain') }}-${{ hashFiles('lakefile.lean') }}-${{ hashFiles('lake-manifest.json') }}-${{ github.run_id }}"
@@ -459,7 +459,7 @@
       {
         "name": "Download prepared Lean workspace build",
         "if": "steps.local-restore-lean-workspace.outcome != 'success'",
-        "uses": "actions/download-artifact@v7",
+        "uses": "actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131",
         "with": {
           "name": "lean-workspace-build"
         }
@@ -478,7 +478,7 @@
       },
       {
         "name": "Upload difftest interpreter",
-        "uses": "actions/upload-artifact@v7",
+        "uses": "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a",
         "with": {
           "name": "difftest-interpreter",
           "path": ".lake/build/bin/difftest-interpreter"
@@ -486,7 +486,7 @@
       },
       {
         "name": "Upload compiler binaries",
-        "uses": "actions/upload-artifact@v7",
+        "uses": "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a",
         "with": {
           "name": "verity-compiler-binaries",
           "path": "compiler/bin",
@@ -495,7 +495,7 @@
       },
       {
         "name": "Upload compiler workspace build",
-        "uses": "actions/upload-artifact@v7",
+        "uses": "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a",
         "with": {
           "name": "lean-workspace-compiler-build",
           "path": "lean-workspace-compiler-build.tar",
@@ -504,7 +504,7 @@
       },
       {
         "name": "Upload generated Yul",
-        "uses": "actions/upload-artifact@v7",
+        "uses": "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a",
         "with": {
           "name": "generated-yul",
           "path": "compiler/yul"
@@ -512,7 +512,7 @@
       },
       {
         "name": "Upload patched Yul",
-        "uses": "actions/upload-artifact@v7",
+        "uses": "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a",
         "with": {
           "name": "generated-yul-patched",
           "path": "compiler/yul-patched"
@@ -520,7 +520,7 @@
       },
       {
         "name": "Upload smoke Yul",
-        "uses": "actions/upload-artifact@v7",
+        "uses": "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a",
         "with": {
           "name": "generated-yul-smoke",
           "path": "compiler/yul-smoke"
@@ -528,7 +528,7 @@
       },
       {
         "name": "Upload patched smoke Yul",
-        "uses": "actions/upload-artifact@v7",
+        "uses": "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a",
         "with": {
           "name": "generated-yul-patched-smoke",
           "path": "compiler/yul-patched-smoke"
@@ -536,7 +536,7 @@
       },
       {
         "name": "Upload patch coverage report",
-        "uses": "actions/upload-artifact@v7",
+        "uses": "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a",
         "with": {
           "name": "patch-coverage-report",
           "path": "compiler/patch-report.tsv"
@@ -544,7 +544,7 @@
       },
       {
         "name": "Upload static gas report",
-        "uses": "actions/upload-artifact@v7",
+        "uses": "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a",
         "with": {
           "name": "static-gas-report",
           "path": "gas-report-static.tsv"
@@ -552,7 +552,7 @@
       },
       {
         "name": "Upload patched static gas report",
-        "uses": "actions/upload-artifact@v7",
+        "uses": "actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a",
         "with": {
           "name": "static-gas-report-patched",
           "path": "gas-report-static-patched.tsv"
@@ -561,7 +561,7 @@
     ],
     "compiler-audits": [
       {
-        "uses": "actions/checkout@v6",
+        "uses": "actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803",
         "with": {
           "submodules": "recursive"
         }
@@ -585,7 +585,7 @@
       {
         "name": "Download prepared Lean workspace build",
         "if": "steps.local-restore-lean-workspace.outcome != 'success'",
-        "uses": "actions/download-artifact@v7",
+        "uses": "actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131",
         "with": {
           "name": "lean-workspace-build"
         }
@@ -597,7 +597,7 @@
       {
         "name": "Download compiler workspace build",
         "if": "steps.local-restore-compiler-workspace.outcome != 'success'",
-        "uses": "actions/download-artifact@v7",
+        "uses": "actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131",
         "with": {
           "name": "lean-workspace-compiler-build"
         }
@@ -609,7 +609,7 @@
     ],
     "compiler-regressions": [
       {
-        "uses": "actions/checkout@v6",
+        "uses": "actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803",
         "with": {
           "submodules": "recursive"
         }
@@ -633,7 +633,7 @@
       {
         "name": "Download prepared Lean workspace build",
         "if": "steps.local-restore-lean-workspace.outcome != 'success'",
-        "uses": "actions/download-artifact@v7",
+        "uses": "actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131",
         "with": {
           "name": "lean-workspace-build"
         }
@@ -645,7 +645,7 @@
       {
         "name": "Download compiler workspace build",
         "if": "steps.local-restore-compiler-workspace.outcome != 'success'",
-        "uses": "actions/download-artifact@v7",
+        "uses": "actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131",
         "with": {
           "name": "lean-workspace-compiler-build"
         }
@@ -669,7 +669,7 @@
     ],
     "lean-profile": [
       {
-        "uses": "actions/checkout@v6"
+        "uses": "actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803"
       },
       {
         "name": "Setup Lean",
@@ -683,7 +683,7 @@
     ],
     "foundry-gas-calibration": [
       {
-        "uses": "actions/checkout@v6",
+        "uses": "actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803",
         "with": {
           "submodules": "recursive"
         }
@@ -695,7 +695,7 @@
     ],
     "foundry": [
       {
-        "uses": "actions/checkout@v6",
+        "uses": "actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803",
         "with": {
           "submodules": "recursive"
         }
@@ -707,7 +707,7 @@
       {
         "name": "Download compiler binaries",
         "if": "steps.local-restore-compiler-binaries.outcome != 'success'",
-        "uses": "actions/download-artifact@v7",
+        "uses": "actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131",
         "with": {
           "name": "verity-compiler-binaries",
           "path": "compiler/bin"
@@ -720,7 +720,7 @@
     ],
     "foundry-patched": [
       {
-        "uses": "actions/checkout@v6",
+        "uses": "actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803",
         "with": {
           "submodules": "recursive"
         }
@@ -732,7 +732,7 @@
       {
         "name": "Download prepared Lean workspace build",
         "if": "steps.local-restore-lean-workspace.outcome != 'success'",
-        "uses": "actions/download-artifact@v7",
+        "uses": "actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131",
         "with": {
           "name": "lean-workspace-build"
         }
@@ -744,7 +744,7 @@
       {
         "name": "Download compiler workspace build",
         "if": "steps.local-restore-compiler-workspace.outcome != 'success'",
-        "uses": "actions/download-artifact@v7",
+        "uses": "actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131",
         "with": {
           "name": "lean-workspace-compiler-build"
         }
@@ -760,7 +760,7 @@
     ],
     "foundry-multi-seed": [
       {
-        "uses": "actions/checkout@v6",
+        "uses": "actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803",
         "with": {
           "submodules": "recursive"
         }
@@ -772,7 +772,7 @@
       {
         "name": "Download compiler binaries",
         "if": "steps.local-restore-compiler-binaries.outcome != 'success'",
-        "uses": "actions/download-artifact@v7",
+        "uses": "actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131",
         "with": {
           "name": "verity-compiler-binaries",
           "path": "compiler/bin"
@@ -786,7 +786,7 @@
     "failure-hints": [
       {
         "name": "Post CI failure hints",
-        "uses": "actions/github-script@v7",
+        "uses": "actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b",
         "env": {
           "NEEDS_JSON": "${{ toJson(needs) }}"
         },
diff --git a/scripts/verify_sync_spec_source.py b/scripts/verify_sync_spec_source.py
index 1ad26c6901..d54154c52c 100644
--- a/scripts/verify_sync_spec_source.py
+++ b/scripts/verify_sync_spec_source.py
@@ -217,8 +217,8 @@
                            'VERIFY_MAIN_CACHE_BUCKET': 'ref-main',
                            'VERIFY_LOCAL_ARTIFACT_ROOT': '/srv/verity-ci-cache/artifacts'},
  'build_compiler_job_names': ['build-compiler-binaries'],
- 'expected_step_contracts': {'changes': [{'uses': 'actions/checkout@v6'},
-                                         {'id': 'filter', 'uses': 'dorny/paths-filter@v4'},
+ 'expected_step_contracts': {'changes': [{'uses': 'actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803'},
+                                         {'id': 'filter', 'uses': 'dorny/paths-filter@ceb8a2b8f2d89434be7ff52d3de7ec3738c5cc9d'},
                                          {'id': 'effective',
                                           'name': 'Resolve effective change flags',
                                           'run': 'if [ "$FORCE_FULL_RUN" = "true" ]; then\n'
@@ -240,12 +240,12 @@
                                                   'CODE_CHANGED': '${{ steps.filter.outputs.code }}',
                                                   'BUILD_CHANGED': '${{ steps.filter.outputs.build }}',
                                                   'COMPILER_CHANGED': '${{ steps.filter.outputs.compiler }}'}}],
-                             'checks': [{'uses': 'actions/checkout@v6',
+                             'checks': [{'uses': 'actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803',
                                          'with': {'path': 'checks-${{ github.run_id }}-${{ github.run_attempt }}'}},
                                         {'name': 'Materialize reused checkout',
                                          'run': 'git reset --hard HEAD'},
                                         {'name': 'Run all checks', 'run': 'make check'}],
-                             'timeout-watchdog': [{'uses': 'actions/checkout@v6',
+                             'timeout-watchdog': [{'uses': 'actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803',
                                                    'with': {'path': 'watchdog-${{ github.run_id }}-${{ github.run_attempt }}'}},
                                                   {'name': 'Warn on timeout-risk trend',
                                                    'env': {'GH_TOKEN': '${{ github.token }}'},
@@ -256,7 +256,7 @@
                                                           '  --branch ${{ '
                                                           'github.event.pull_request.base.ref || '
                                                           'github.ref_name }}'}],
-                             'build': [{'uses': 'actions/checkout@v6',
+                             'build': [{'uses': 'actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803',
                                         'with': {'submodules': 'recursive'}},
                                        {'name': 'Materialize reused checkout',
                                         'run': 'git reset --hard HEAD'},
@@ -299,11 +299,11 @@
                                                '  exit "${build_status}"\n'
                                                'fi'},
                                        {'name': 'Upload prepared Lean workspace build',
-                                        'uses': 'actions/upload-artifact@v7',
+                                        'uses': 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a',
                                         'with': {'name': 'lean-workspace-build',
                                                  'path': 'lean-workspace-build.tar'}},
                                        {'name': 'Save current run Lake cache',
-                                        'uses': 'actions/cache/save@v5',
+                                        'uses': 'actions/cache/save@caa296126883cff596d87d8935842f9db880ef25',
                                         'if': "success() && needs.changes.outputs.build == 'true' "
                                               "&& steps.setup-lean.outputs.using-sticky-disks != "
                                               "'true'",
@@ -314,7 +314,7 @@
                                                         "hashFiles('lake-manifest.json') }}-${{ "
                                                         'github.run_id }}'}},
                                        {'name': 'Save Lake packages cache',
-                                        'uses': 'actions/cache/save@v5',
+                                        'uses': 'actions/cache/save@caa296126883cff596d87d8935842f9db880ef25',
                                         'if': "success() && needs.changes.outputs.build == 'true' "
                                               "&& steps.setup-lean.outputs.using-sticky-disks != "
                                               "'true' && "
@@ -324,7 +324,7 @@
                                                         "hashFiles('lean-toolchain') }}-${{ "
                                                         "hashFiles('lakefile.lean') }}-${{ "
                                                         "hashFiles('lake-manifest.json') }}"}}],
-                             'build-audits': [{'uses': 'actions/checkout@v6',
+                             'build-audits': [{'uses': 'actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803',
                                                'with': {'submodules': 'recursive'}},
                                               {'name': 'Setup Lean',
                                                'uses': './.github/actions/setup-lean',
@@ -345,14 +345,14 @@
                                                'run': 'scripts/ci_local_persistence.sh fetch \\\n  --run-id "${{ github.run_id }}" \\\n  --name lean-workspace-build \\\n  --timeout 60'},
                                               {'name': 'Download prepared Lean workspace build',
                                                'if': "steps.local-restore-lean-workspace.outcome != 'success'",
-                                               'uses': 'actions/download-artifact@v7',
+                                               'uses': 'actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131',
                                                'with': {'name': 'lean-workspace-build'}},
                                               {'name': 'Upload axiom dependency report',
-                                               'uses': 'actions/upload-artifact@v7',
+                                               'uses': 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a',
                                                'with': {'name': 'axiom-dependency-report',
                                                         'path': 'axiom-report.md\n'
                                                                 'axiom-report-raw.log'}}],
-                             'build-compiler-binaries': [{'uses': 'actions/checkout@v6',
+                             'build-compiler-binaries': [{'uses': 'actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803',
                                                           'with': {'submodules': 'recursive'}},
                                                          {'name': 'Setup Lean',
                                                           'uses': './.github/actions/setup-lean',
@@ -387,10 +387,10 @@
                                                           'run': 'scripts/ci_local_persistence.sh fetch \\\n  --run-id "${{ github.run_id }}" \\\n  --name lean-workspace-build \\\n  --timeout 60'},
                                                          {'name': 'Download prepared Lean workspace build',
                                                           'if': "steps.local-restore-lean-workspace.outcome != 'success'",
-                                                          'uses': 'actions/download-artifact@v7',
+                                                          'uses': 'actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131',
                                                           'with': {'name': 'lean-workspace-build'}},
                                                          {'name': 'Restore compiler ccache fallback cache',
-                                                          'uses': 'actions/cache/restore@v5',
+                                                          'uses': 'actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25',
                                                           'with': {'path': '${{ runner.temp }}/compiler-ccache-cache',
                                                                    'key': 'compiler-ccache-cache-${{ '
                                                                           'env.VERIFY_CACHE_BUCKET '
@@ -403,11 +403,11 @@
                                                                           "hashFiles('lake-manifest.json') "
                                                                           '}}-${{ github.run_id }}'}},
                                                          {'name': 'Upload compiler workspace build',
-                                                          'uses': 'actions/upload-artifact@v7',
+                                                          'uses': 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a',
                                                           'with': {'name': 'lean-workspace-compiler-build',
                                                                    'path': 'lean-workspace-compiler-build.tar'}},
                                                          {'name': 'Save compiler ccache fallback cache',
-                                                          'uses': 'actions/cache/save@v5',
+                                                          'uses': 'actions/cache/save@caa296126883cff596d87d8935842f9db880ef25',
                                                           'if': 'always() && (failure() || '
                                                                 "steps.setup-lean.outputs.using-sticky-disks != 'true')",
                                                           'with': {'path': '${{ github.workspace }}/.cache/ccache',
@@ -422,7 +422,7 @@
                                                                           "hashFiles('lake-manifest.json') "
                                                                           '}}-${{ github.run_id }}'}},
                                                          {'name': 'Save Lake compiler cache',
-                                                          'uses': 'actions/cache/save@v5',
+                                                          'uses': 'actions/cache/save@caa296126883cff596d87d8935842f9db880ef25',
                                                           'if': 'always() && '
                                                                 "steps.setup-lean.outputs.using-sticky-disks "
                                                                 "!= 'true'",
@@ -435,7 +435,7 @@
                                                                           '}}-${{ '
                                                                           "hashFiles('lake-manifest.json') "
                                                                           '}}-${{ github.run_id }}'}}],
-                             'compiler-audits': [{'uses': 'actions/checkout@v6',
+                             'compiler-audits': [{'uses': 'actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803',
                                                   'with': {'submodules': 'recursive'}},
                                                  {'name': 'Setup Lean',
                                                   'uses': './.github/actions/setup-lean',
@@ -467,17 +467,17 @@
                                                   'run': 'scripts/ci_local_persistence.sh fetch \\\n  --run-id "${{ github.run_id }}" \\\n  --name lean-workspace-build \\\n  --timeout 60'},
                                                  {'name': 'Download prepared Lean workspace build',
                                                   'if': "steps.local-restore-lean-workspace.outcome != 'success'",
-                                                  'uses': 'actions/download-artifact@v7',
+                                                  'uses': 'actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131',
                                                   'with': {'name': 'lean-workspace-build'}},
                                                  {'name': 'Restore compiler workspace build (local)',
                                                   'run': 'scripts/ci_local_persistence.sh fetch \\\n  --run-id "${{ github.run_id }}" \\\n  --name lean-workspace-compiler-build \\\n  --timeout 60'},
                                                  {'name': 'Download compiler workspace build',
                                                   'if': "steps.local-restore-compiler-workspace.outcome != 'success'",
-                                                  'uses': 'actions/download-artifact@v7',
+                                                  'uses': 'actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131',
                                                   'with': {'name': 'lean-workspace-compiler-build'}},
                                                  {'name': 'Setup solc',
                                                   'uses': './.github/actions/setup-solc'}],
-                             'compiler-regressions': [{'uses': 'actions/checkout@v6',
+                             'compiler-regressions': [{'uses': 'actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803',
                                                        'with': {'submodules': 'recursive'}},
                                                       {'name': 'Setup Lean',
                                                        'uses': './.github/actions/setup-lean',
@@ -511,13 +511,13 @@
                                                        'run': 'scripts/ci_local_persistence.sh fetch \\\n  --run-id "${{ github.run_id }}" \\\n  --name lean-workspace-build \\\n  --timeout 60'},
                                                       {'name': 'Download prepared Lean workspace build',
                                                        'if': "steps.local-restore-lean-workspace.outcome != 'success'",
-                                                       'uses': 'actions/download-artifact@v7',
+                                                       'uses': 'actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131',
                                                        'with': {'name': 'lean-workspace-build'}},
                                                       {'name': 'Restore compiler workspace build (local)',
                                                        'run': 'scripts/ci_local_persistence.sh fetch \\\n  --run-id "${{ github.run_id }}" \\\n  --name lean-workspace-compiler-build \\\n  --timeout 60'},
                                                       {'name': 'Download compiler workspace build',
                                                        'if': "steps.local-restore-compiler-workspace.outcome != 'success'",
-                                                       'uses': 'actions/download-artifact@v7',
+                                                       'uses': 'actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131',
                                                        'with': {'name': 'lean-workspace-compiler-build'}},
                                                       {'name': 'Build compiler CLI regression executable',
                                                        'run': 'stdbuf -oL -eL lake build compiler-main-test'},
@@ -529,58 +529,58 @@
                                                                'Compiler.CompilationModelFeatureTest'},
                                                       {'name': 'Build panic-code regression module',
                                                        'run': 'stdbuf -oL -eL lake build Compiler.PanicCodeRegressionTest'}],
-                             'lean-profile': [{'uses': 'actions/checkout@v6'},
+                             'lean-profile': [{'uses': 'actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803'},
                                              {'name': 'Setup Lean',
                                               'uses': './.github/actions/setup-lean',
                                                'with': {'use-sticky-disks': '${{ env.VERIFY_USE_STICKY_DISKS }}',
                                                         'sticky-disk-key-prefix': 'verify',
                                                         'disable-lake-cache-restore': '${{ env.VERIFY_DISABLE_LAKE_CACHE_RESTORE }}'}}],
-                             'foundry-gas-calibration': [{'uses': 'actions/checkout@v6',
+                             'foundry-gas-calibration': [{'uses': 'actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803',
                                                           'with': {'submodules': 'recursive'}},
                                                          {'name': 'Setup Foundry environment',
                                                           'uses': './.github/actions/setup-foundry'}],
-                             'foundry': [{'uses': 'actions/checkout@v6',
+                             'foundry': [{'uses': 'actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803',
                                           'with': {'submodules': 'recursive'}},
                                          {'name': 'Restore compiler binaries (local)',
                                           'run': 'source_dir="${VERIFY_LOCAL_ARTIFACT_ROOT}/${{ github.run_id }}/verity-compiler-binaries"\nif [ -f "$source_dir/.ready" ]; then\n  mkdir -p compiler/bin\n  cp -a "$source_dir/." compiler/bin/\n  rm -f compiler/bin/.ready\nelse\n  exit 1\nfi'},
                                          {'name': 'Download compiler binaries',
                                           'if': "steps.local-restore-compiler-binaries.outcome != 'success'",
-                                          'uses': 'actions/download-artifact@v7',
+                                          'uses': 'actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131',
                                           'with': {'name': 'verity-compiler-binaries',
                                                    'path': 'compiler/bin'}},
                                          {'name': 'Setup Foundry environment',
                                           'uses': './.github/actions/setup-foundry'}],
-                             'foundry-patched': [{'uses': 'actions/checkout@v6',
+                             'foundry-patched': [{'uses': 'actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803',
                                                   'with': {'submodules': 'recursive'}},
                                                  {'name': 'Restore prepared Lean workspace build (local)',
                                                   'run': 'scripts/ci_local_persistence.sh fetch \\\n  --run-id "${{ github.run_id }}" \\\n  --name lean-workspace-build \\\n  --timeout 60'},
                                                  {'name': 'Download prepared Lean workspace build',
                                                   'if': "steps.local-restore-lean-workspace.outcome != 'success'",
-                                                  'uses': 'actions/download-artifact@v7',
+                                                  'uses': 'actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131',
                                                   'with': {'name': 'lean-workspace-build'}},
                                                  {'name': 'Restore compiler workspace build (local)',
                                                   'run': 'scripts/ci_local_persistence.sh fetch \\\n  --run-id "${{ github.run_id }}" \\\n  --name lean-workspace-compiler-build \\\n  --timeout 60'},
                                                  {'name': 'Download compiler workspace build',
                                                   'if': "steps.local-restore-compiler-workspace.outcome != 'success'",
-                                                  'uses': 'actions/download-artifact@v7',
+                                                  'uses': 'actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131',
                                                   'with': {'name': 'lean-workspace-compiler-build'}},
                                                  {'name': 'Setup Foundry environment',
                                                   'uses': './.github/actions/setup-foundry',
                                                   'with': {'yul-artifact-name': 'generated-yul-patched',
                                                            'yul-artifact-path': 'compiler/yul-patched'}}],
-                             'foundry-multi-seed': [{'uses': 'actions/checkout@v6',
+                             'foundry-multi-seed': [{'uses': 'actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803',
                                                      'with': {'submodules': 'recursive'}},
                                                     {'name': 'Restore compiler binaries (local)',
                                                      'run': 'source_dir="${VERIFY_LOCAL_ARTIFACT_ROOT}/${{ github.run_id }}/verity-compiler-binaries"\nif [ -f "$source_dir/.ready" ]; then\n  mkdir -p compiler/bin\n  cp -a "$source_dir/." compiler/bin/\n  rm -f compiler/bin/.ready\nelse\n  exit 1\nfi'},
                                                     {'name': 'Download compiler binaries',
                                                      'if': "steps.local-restore-compiler-binaries.outcome != 'success'",
-                                                     'uses': 'actions/download-artifact@v7',
+                                                     'uses': 'actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131',
                                                      'with': {'name': 'verity-compiler-binaries',
                                                               'path': 'compiler/bin'}},
                                                     {'name': 'Setup Foundry environment',
                                                      'uses': './.github/actions/setup-foundry'}],
                              'failure-hints': [{'name': 'Post CI failure hints',
-                                                'uses': 'actions/github-script@v7',
+                                                'uses': 'actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b',
                                                 'env': {'NEEDS_JSON': '${{ toJson(needs) }}'},
                                                 'with': {'script': 'const marker = "<!-- '
                                                                    'ci-failure-hints -->";\n'
@@ -862,27 +862,27 @@
 ]
 
 SPEC['expected_step_contracts']['build-compiler-binaries'] = [
-    {'uses': 'actions/checkout@v6', 'with': {'submodules': 'recursive'}},
+    {'uses': 'actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803', 'with': {'submodules': 'recursive'}},
     {'name': 'Restore compiler ccache fallback cache',
      'if': "env.VERIFY_CLEAN_BUILD != 'true'",
-     'uses': 'actions/cache/restore@v5',
+     'uses': 'actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25',
      'with': {'path': '${{ runner.temp }}/compiler-ccache-cache',
               'key': "compiler-ccache-cache-${{ env.VERIFY_CACHE_BUCKET }}-${{ runner.os }}-${{ hashFiles('lean-toolchain') }}-${{ hashFiles('lakefile.lean') }}-${{ hashFiles('lake-manifest.json') }}-${{ github.run_id }}"}},
     {'name': 'Restore prepared Lean workspace build (local)', 'run': 'scripts/ci_local_persistence.sh fetch \\\n  --run-id "${{ github.run_id }}" \\\n  --name lean-workspace-build \\\n  --timeout 60'},
-    {'name': 'Download prepared Lean workspace build', 'if': "steps.local-restore-lean-workspace.outcome != 'success'", 'uses': 'actions/download-artifact@v7', 'with': {'name': 'lean-workspace-build'}},
+    {'name': 'Download prepared Lean workspace build', 'if': "steps.local-restore-lean-workspace.outcome != 'success'", 'uses': 'actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131', 'with': {'name': 'lean-workspace-build'}},
     {'name': 'Build verity-compiler', 'uses': './.github/actions/build-compiler-target'},
     {'name': 'Build difftest-interpreter', 'uses': './.github/actions/build-compiler-target'},
     {'name': 'Build gas-report', 'uses': './.github/actions/build-compiler-target'},
-    {'name': 'Upload difftest interpreter', 'uses': 'actions/upload-artifact@v7', 'with': {'name': 'difftest-interpreter', 'path': '.lake/build/bin/difftest-interpreter'}},
-    {'name': 'Upload compiler binaries', 'uses': 'actions/upload-artifact@v7', 'with': {'name': 'verity-compiler-binaries', 'path': 'compiler/bin', 'compression-level': '0'}},
-    {'name': 'Upload compiler workspace build', 'uses': 'actions/upload-artifact@v7', 'with': {'name': 'lean-workspace-compiler-build', 'path': 'lean-workspace-compiler-build.tar', 'compression-level': '0'}},
-    {'name': 'Upload generated Yul', 'uses': 'actions/upload-artifact@v7', 'with': {'name': 'generated-yul', 'path': 'compiler/yul'}},
-    {'name': 'Upload patched Yul', 'uses': 'actions/upload-artifact@v7', 'with': {'name': 'generated-yul-patched', 'path': 'compiler/yul-patched'}},
-    {'name': 'Upload smoke Yul', 'uses': 'actions/upload-artifact@v7', 'with': {'name': 'generated-yul-smoke', 'path': 'compiler/yul-smoke'}},
-    {'name': 'Upload patched smoke Yul', 'uses': 'actions/upload-artifact@v7', 'with': {'name': 'generated-yul-patched-smoke', 'path': 'compiler/yul-patched-smoke'}},
-    {'name': 'Upload patch coverage report', 'uses': 'actions/upload-artifact@v7', 'with': {'name': 'patch-coverage-report', 'path': 'compiler/patch-report.tsv'}},
-    {'name': 'Upload static gas report', 'uses': 'actions/upload-artifact@v7', 'with': {'name': 'static-gas-report', 'path': 'gas-report-static.tsv'}},
-    {'name': 'Upload patched static gas report', 'uses': 'actions/upload-artifact@v7', 'with': {'name': 'static-gas-report-patched', 'path': 'gas-report-static-patched.tsv'}},
+    {'name': 'Upload difftest interpreter', 'uses': 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a', 'with': {'name': 'difftest-interpreter', 'path': '.lake/build/bin/difftest-interpreter'}},
+    {'name': 'Upload compiler binaries', 'uses': 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a', 'with': {'name': 'verity-compiler-binaries', 'path': 'compiler/bin', 'compression-level': '0'}},
+    {'name': 'Upload compiler workspace build', 'uses': 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a', 'with': {'name': 'lean-workspace-compiler-build', 'path': 'lean-workspace-compiler-build.tar', 'compression-level': '0'}},
+    {'name': 'Upload generated Yul', 'uses': 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a', 'with': {'name': 'generated-yul', 'path': 'compiler/yul'}},
+    {'name': 'Upload patched Yul', 'uses': 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a', 'with': {'name': 'generated-yul-patched', 'path': 'compiler/yul-patched'}},
+    {'name': 'Upload smoke Yul', 'uses': 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a', 'with': {'name': 'generated-yul-smoke', 'path': 'compiler/yul-smoke'}},
+    {'name': 'Upload patched smoke Yul', 'uses': 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a', 'with': {'name': 'generated-yul-patched-smoke', 'path': 'compiler/yul-patched-smoke'}},
+    {'name': 'Upload patch coverage report', 'uses': 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a', 'with': {'name': 'patch-coverage-report', 'path': 'compiler/patch-report.tsv'}},
+    {'name': 'Upload static gas report', 'uses': 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a', 'with': {'name': 'static-gas-report', 'path': 'gas-report-static.tsv'}},
+    {'name': 'Upload patched static gas report', 'uses': 'actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a', 'with': {'name': 'static-gas-report-patched', 'path': 'gas-report-static-patched.tsv'}},
 ]
 
 SPEC['expected_uploaded_artifacts'] = {