diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index 290bd13a7..cc3954b35 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -21,7 +21,7 @@ jobs:
       configurations: ${{ steps.configurations.outputs.names }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: List smoke-test configurations
         id: configurations
@@ -30,10 +30,10 @@ jobs:
           echo "names=$names" >> "$GITHUB_OUTPUT"
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Expose GitHub Actions runtime for buildx cache
-        uses: crazy-max/ghaction-github-runtime@v3
+        uses: crazy-max/ghaction-github-runtime@04d248b84655b509d8c44dc1d6f990c879747487 # v4.0.0
 
       - name: Build and run tests
         run: |
@@ -51,7 +51,7 @@ jobs:
         run: tar czf openintegrationengine.tar.gz -C docker-build-output/app/server setup --transform 's|^setup|openintegrationengine/|'
 
       - name: Create artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: oie-build
           path: openintegrationengine.tar.gz
@@ -67,7 +67,7 @@ jobs:
 
       - name: Upload Test Results
         if: (!cancelled())
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: Test Results (unit)
           path: |
@@ -83,13 +83,13 @@ jobs:
         configuration: ${{ fromJSON(needs.build.outputs.configurations) }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: Expose GitHub Actions runtime for buildx cache
-        uses: crazy-max/ghaction-github-runtime@v3
+        uses: crazy-max/ghaction-github-runtime@04d248b84655b509d8c44dc1d6f990c879747487 # v4.0.0
 
       # Read-only: the build job populates this cache, and concurrent writers
       # from the matrix would just fight over the same scope.
@@ -100,7 +100,7 @@ jobs:
 
       - name: Upload Test Results
         if: (!cancelled())
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: Test Results (${{ matrix.configuration }})
           path: |
@@ -113,12 +113,12 @@ jobs:
 
     steps:
       - name: Upload Event File
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: Event File
           path: ${{ github.event_path }}
       - name: Merge Test Results
-        uses: actions/upload-artifact/merge@v4
+        uses: actions/upload-artifact/merge@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: Test Results
           pattern: Test Results (*)
diff --git a/.github/workflows/upload_test_results.yaml b/.github/workflows/upload_test_results.yaml
index 21ab857bb..1bd3d332b 100644
--- a/.github/workflows/upload_test_results.yaml
+++ b/.github/workflows/upload_test_results.yaml
@@ -23,14 +23,14 @@ jobs:
 
     steps:
       - name: Download and Extract Artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
            run-id: ${{ github.event.workflow_run.id }}
            github-token: ${{ secrets.GITHUB_TOKEN }}
            path: artifacts
 
       - name: Publish Test Results
-        uses: EnricoMi/publish-unit-test-result-action@v2
+        uses: EnricoMi/publish-unit-test-result-action@7622c5bf3d112a72ab4fa3951c2aa5723d8ab92d # v2.25.0
         with:
           commit: ${{ github.event.workflow_run.head_sha }}
           event_file: artifacts/Event File/event.json
diff --git a/renovate.json b/renovate.json
index 9c37dfb45..9b71c32a3 100644
--- a/renovate.json
+++ b/renovate.json
@@ -2,7 +2,8 @@
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
   "extends": [
     "config:recommended",
-    "schedule:monthly"
+    "schedule:monthly",
+    "helpers:pinGitHubActionDigests"
   ],
   "timezone": "America/New_York",
   "minimumReleaseAge": "14 days",
@@ -37,6 +38,14 @@
         "docker"
       ]
     },
+    {
+      "matchManagers": [
+        "github-actions"
+      ],
+      "addLabels": [
+        "github actions"
+      ]
+    },
     {
       "groupName": "aws-sdk",
       "matchPackageNames": [