diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 8fd2106..91e9146 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -16,10 +16,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 🏗 Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: 🏗 Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         with:
           node-version-file: ".nvmrc"
           cache: "yarn"
@@ -29,7 +29,7 @@ jobs:
         run: echo "dir=$(yarn config get cacheFolder)" >> $GITHUB_OUTPUT
 
       - name: 📦 Setup yarn cache
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
         with:
           path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
           key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
@@ -53,10 +53,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 🏗 Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: 🏗 Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         with:
           node-version-file: ".nvmrc"
           cache: "yarn"
@@ -66,7 +66,7 @@ jobs:
         run: echo "dir=$(yarn config get cacheFolder)" >> $GITHUB_OUTPUT
 
       - name: 📦 Setup yarn cache
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
         with:
           path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
           key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
@@ -115,7 +115,7 @@ jobs:
           NODE_ENV: development
 
       - name: 📦 Upload build artifact to GitHub
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: app-builds-android
           path: ./example/app-dev.apk
@@ -126,15 +126,15 @@ jobs:
     runs-on: macos-latest
     steps:
       - name: 🏗 Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: 🏗 Select Xcode (Expo SDK 55 requires >=26.0)
-        uses: maxim-lobanov/setup-xcode@v1
+        uses: maxim-lobanov/setup-xcode@ed7a3b1fda3918c0306d1b724322adc0b8cc0a90
         with:
           xcode-version: latest-stable
 
       - name: 🏗 Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         with:
           node-version-file: ".nvmrc"
           cache: "yarn"
@@ -144,7 +144,7 @@ jobs:
         run: echo "dir=$(yarn config get cacheFolder)" >> $GITHUB_OUTPUT
 
       - name: 📦 Setup yarn cache
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
         with:
           path: ${{ steps.yarn-cache-dir-path.outputs.dir }}
           key: ${{ runner.os }}-yarn-${{ hashFiles('**/yarn.lock') }}
@@ -186,7 +186,7 @@ jobs:
           NODE_ENV: development
 
       - name: 📦 Upload build artifact to GitHub
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           name: app-builds-ios
           path: ./example/app-ios-dev.app
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index d14e34c..af9ea82 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -14,9 +14,9 @@ jobs:
       packages: write
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - name: node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         with:
           node-version-file: '.nvmrc'
           registry-url: https://registry.npmjs.org
diff --git a/.github/workflows/release-dynamic.yml b/.github/workflows/release-dynamic.yml
index 31f8bab..0d365fa 100644
--- a/.github/workflows/release-dynamic.yml
+++ b/.github/workflows/release-dynamic.yml
@@ -42,7 +42,7 @@ jobs:
           } >> "$GITHUB_OUTPUT"
 
       - name: Checkout static release tag
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           ref: v${{ steps.version.outputs.static_version }}
           fetch-depth: 0
diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml
index a2b5816..5ecb30c 100644
--- a/.github/workflows/security.yml
+++ b/.github/workflows/security.yml
@@ -10,9 +10,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
       - name: Install node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         with:
           node-version-file: ".nvmrc"
           cache: yarn
diff --git a/.github/workflows/update-ios-sdk.yml b/.github/workflows/update-ios-sdk.yml
index f9a4da7..054a80f 100644
--- a/.github/workflows/update-ios-sdk.yml
+++ b/.github/workflows/update-ios-sdk.yml
@@ -34,7 +34,7 @@ jobs:
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
           echo "branch=chore/update-ios-sdk-${VERSION}" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           ref: master
           repository: atomicfi/atomic-transact-react-native
diff --git a/.github/workflows/update-test-app.yml b/.github/workflows/update-test-app.yml
index e1c3963..bcb8b68 100644
--- a/.github/workflows/update-test-app.yml
+++ b/.github/workflows/update-test-app.yml
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Trigger sdk-upgrade workflow in test app
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3
         with:
           github-token: ${{ secrets.SDK_TEST_APPS_TOKEN }}
           script: |