diff --git a/.github/workflows/build-and-release.yaml b/.github/workflows/build-and-release.yaml
index 294c4500..9462c640 100644
--- a/.github/workflows/build-and-release.yaml
+++ b/.github/workflows/build-and-release.yaml
@@ -195,7 +195,7 @@ jobs:
         run: |
           docker login --username="$DOCKER_USERNAME" --password-stdin $DOCKER_REGISTRY <<< "$DOCKER_PASSWORD"
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3
       - name: Create and push multi-arch manifests
         run: |
           docker_registry=$(sed -e 's,^https://,,' -e 's,/*$,,' <<< $DOCKER_REGISTRY)
@@ -236,7 +236,7 @@ jobs:
     if: ${{ inputs.dry_run != true }}
     steps:
       - name: Download all packages
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           pattern: packages-*
           merge-multiple: true
diff --git a/.github/workflows/build-and-test.yaml b/.github/workflows/build-and-test.yaml
index 3a1291e2..dcac68e8 100644
--- a/.github/workflows/build-and-test.yaml
+++ b/.github/workflows/build-and-test.yaml
@@ -88,13 +88,13 @@ jobs:
         fetch-depth: 0
 
     - name: Cache and install ccache
-      uses: awalsh128/cache-apt-pkgs-action@latest
+      uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # latest
       with:
         packages: ccache
         version: 1.0
 
     - name: Setup ccache
-      uses: hendrikmuhs/ccache-action@v1.2
+      uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2
       with:
         key: ccache-build-reducer
         max-size: 1G
@@ -154,13 +154,13 @@ jobs:
         fetch-depth: 0
 
     - name: Cache and install ccache
-      uses: awalsh128/cache-apt-pkgs-action@latest
+      uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # latest
       with:
         packages: ccache
         version: 1.0
 
     - name: Setup ccache
-      uses: hendrikmuhs/ccache-action@v1.2
+      uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2
       with:
         key: ccache-build-kernel-collector
         max-size: 1G
@@ -220,13 +220,13 @@ jobs:
         fetch-depth: 0
 
     - name: Cache and install ccache
-      uses: awalsh128/cache-apt-pkgs-action@latest
+      uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # latest
       with:
         packages: ccache
         version: 1.0
 
     - name: Setup ccache
-      uses: hendrikmuhs/ccache-action@v1.2
+      uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2
       with:
         key: ccache-build-kernel-collector-test
         max-size: 1G
@@ -286,13 +286,13 @@ jobs:
         fetch-depth: 0
 
     - name: Cache and install ccache
-      uses: awalsh128/cache-apt-pkgs-action@latest
+      uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # latest
       with:
         packages: ccache
         version: 1.0
 
     - name: Setup ccache
-      uses: hendrikmuhs/ccache-action@v1.2
+      uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2
       with:
         key: ccache-build-k8s-collector
         max-size: 1G
@@ -351,13 +351,13 @@ jobs:
         fetch-depth: 0
 
     - name: Cache and install ccache
-      uses: awalsh128/cache-apt-pkgs-action@latest
+      uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # latest
       with:
         packages: ccache
         version: 1.0
 
     - name: Setup ccache
-      uses: hendrikmuhs/ccache-action@v1.2
+      uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2
       with:
         key: ccache-build-cloud-collector
         max-size: 1G
@@ -392,13 +392,13 @@ jobs:
         fetch-depth: 0
     
     - name: Cache and install ccache
-      uses: awalsh128/cache-apt-pkgs-action@latest
+      uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # latest
       with:
         packages: ccache
         version: 1.0
 
     - name: Setup ccache
-      uses: hendrikmuhs/ccache-action@v1.2
+      uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2
       with:
         key: ccache-build-run-unit-tests
         max-size: 1G
@@ -434,13 +434,13 @@ jobs:
         fetch-depth: 0
 
     - name: Cache and install ccache
-      uses: awalsh128/cache-apt-pkgs-action@latest
+      uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # latest
       with:
         packages: ccache
         version: 1.0
 
     - name: Setup ccache
-      uses: hendrikmuhs/ccache-action@v1.2
+      uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2
       with:
         key: ccache-build-run-unit-tests-asan-debug
         max-size: 1G
@@ -475,13 +475,13 @@ jobs:
         fetch-depth: 0
 
     - name: Cache and install ccache
-      uses: awalsh128/cache-apt-pkgs-action@latest
+      uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # latest
       with:
         packages: ccache
         version: 1.0
 
     - name: Setup ccache
-      uses: hendrikmuhs/ccache-action@v1.2
+      uses: hendrikmuhs/ccache-action@5ebbd400eff9e74630f759d94ddd7b6c26299639 # v1.2
       with:
         key: ccache-build-packages
         max-size: 1G
@@ -530,7 +530,7 @@ jobs:
         fetch-depth: 0
 
     - name: Set up kind cluster
-      uses: helm/kind-action@v1.10.0
+      uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0
       with:
         version: v0.30.0
         cluster_name: e2e-kind
@@ -885,14 +885,14 @@ jobs:
         path: ./container-exports
 
     - name: Cache and install LVH host dependencies
-      uses: awalsh128/cache-apt-pkgs-action@latest
+      uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # latest
       with:
         # Match LVH action.yaml dependency_list exactly
         packages: cpu-checker qemu-system-x86 libvirt-daemon-system libvirt-clients bridge-utils virtinst virt-manager
         version: lvh-deps-1
 
     - name: Run kernel collector simple tests on ${{ matrix.description }}
-      uses: yonch/little-vm-helper@main
+      uses: yonch/little-vm-helper@f2aa2b657a2d6efaddf34793989b5fcdbaad10d6 # main
       with:
         test-name: kernel-collector-simple-test-${{ matrix.kernel }}
         image: 'complexity-test'
@@ -1039,14 +1039,14 @@ jobs:
         path: ./container-exports
 
     - name: Cache and install LVH host dependencies
-      uses: awalsh128/cache-apt-pkgs-action@latest
+      uses: awalsh128/cache-apt-pkgs-action@553a35bb8ebd9fcabcb1c9451aa4c98e1b4ca8a9 # latest
       with:
         # Match LVH action.yaml dependency_list exactly
         packages: cpu-checker qemu-system-x86 libvirt-daemon-system libvirt-clients bridge-utils virtinst virt-manager
         version: lvh-deps-1
 
     - name: Run kernel collector tests on ${{ matrix.description }}
-      uses: yonch/little-vm-helper@main
+      uses: yonch/little-vm-helper@f2aa2b657a2d6efaddf34793989b5fcdbaad10d6 # main
       with:
         test-name: kernel-collector-test-${{ matrix.kernel }}
         image: 'complexity-test'
diff --git a/.github/workflows/k8s-collector-integration.yaml b/.github/workflows/k8s-collector-integration.yaml
index b65542aa..608f52bd 100644
--- a/.github/workflows/k8s-collector-integration.yaml
+++ b/.github/workflows/k8s-collector-integration.yaml
@@ -15,15 +15,15 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Check out the codebase
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Cache Rust build
-        uses: Swatinem/rust-cache@v2
+        uses: Swatinem/rust-cache@e18b497796c12c097a38f9edb9d0641fb99eee32 # v2
         with:
           prefix-key: k8s-collector-integration-${{ runner.os }}
 
       - name: Install Rust toolchain
-        uses: actions-rs/toolchain@v1
+        uses: actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af # v1
         with:
           profile: minimal
           toolchain: stable
@@ -42,7 +42,7 @@ jobs:
           chmod +x k8s-collector-integration
 
       - name: Upload k8s-collector integration binary
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: k8s-collector-integration
           path: k8s-collector-integration
@@ -54,16 +54,16 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Check out the codebase
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Set up kind cluster
-        uses: helm/kind-action@v1.10.0
+        uses: helm/kind-action@0025e74a8c7512023d06dc019c617aa3cf561fde # v1.10.0
         with:
           version: v0.30.0
           cluster_name: k8s-collector-e2e
 
       - name: Download k8s-collector integration binary
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
         with:
           name: k8s-collector-integration
           path: ./
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 9b7eff66..7799b9e1 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -18,7 +18,7 @@ jobs:
     steps:
       - name: Run Release Please
         id: release
-        uses: googleapis/release-please-action@v4
+        uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           config-file: release-please-config.json
diff --git a/crates/k8s-collector/Cargo.toml b/crates/k8s-collector/Cargo.toml
index dbfbdee2..4c9e2cab 100644
--- a/crates/k8s-collector/Cargo.toml
+++ b/crates/k8s-collector/Cargo.toml
@@ -20,8 +20,8 @@ tokio-util = { version = "0.7", features = ["io-util"] }
 hostname = "0.4"
 
 [dev-dependencies]
-k8s-openapi = { version = "0.26", features = ["v1_30"] }
-proptest = "1"
-anyhow = "1"
-env_logger = "0.11"
-serde_json = "1"
+k8s-openapi = { version = "=0.26.0", features = ["v1_30"] }
+proptest = "=1.9.0"
+anyhow = "=1.0.100"
+env_logger = "=0.11.8"
+serde_json = "=1.0.145"
diff --git a/crates/perfect_hash_map/Cargo.toml b/crates/perfect_hash_map/Cargo.toml
index fd2003db..ed65ac12 100644
--- a/crates/perfect_hash_map/Cargo.toml
+++ b/crates/perfect_hash_map/Cargo.toml
@@ -13,4 +13,4 @@ path = "src/lib.rs"
 default = []
 
 [dev-dependencies]
-proptest = "1.4"
+proptest = "=1.9.0"
diff --git a/crates/reducer/Cargo.toml b/crates/reducer/Cargo.toml
index 566f7415..4c4087db 100644
--- a/crates/reducer/Cargo.toml
+++ b/crates/reducer/Cargo.toml
@@ -19,4 +19,4 @@ rc-hashmap = { workspace = true }
 otlp_export = { workspace = true }
 
 [dev-dependencies]
-proptest = "1"
+proptest = "=1.9.0"