diff --git a/.github/workflows/_build.yml b/.github/workflows/_build.yml
index 7456e7872..122fb8d6f 100644
--- a/.github/workflows/_build.yml
+++ b/.github/workflows/_build.yml
@@ -12,10 +12,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           cache: "yarn"
 
@@ -26,7 +26,7 @@ jobs:
         run: yarn build --clean
 
       - name: Upload Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: dist
           path: dist
diff --git a/.github/workflows/autofix.yml b/.github/workflows/autofix.yml
index 23104d40b..547468f20 100644
--- a/.github/workflows/autofix.yml
+++ b/.github/workflows/autofix.yml
@@ -7,6 +7,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions: {}
+
 jobs:
   fix:
     name: Run automated fix
diff --git a/.github/workflows/bundler-friendly.yml b/.github/workflows/bundler-friendly.yml
index 0b5793ef6..fe10cffd5 100644
--- a/.github/workflows/bundler-friendly.yml
+++ b/.github/workflows/bundler-friendly.yml
@@ -1,4 +1,4 @@
-name: Bundler_Friendly
+name: Bundler Friendly
 
 on:
   schedule:
@@ -30,10 +30,10 @@ jobs:
     needs: [build]
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           cache: "yarn"
 
@@ -41,7 +41,7 @@ jobs:
         run: yarn install --immutable
 
       - name: Download Artifact
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
           name: dist
           path: dist
diff --git a/.github/workflows/check-sizes.yml b/.github/workflows/check-sizes.yml
index 7dd326870..87c2b39e4 100644
--- a/.github/workflows/check-sizes.yml
+++ b/.github/workflows/check-sizes.yml
@@ -17,15 +17,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           cache: "yarn"
 
       - name: Check Sizes
-        uses: preactjs/compressed-size-action@2.8.0
+        uses: preactjs/compressed-size-action@946a292cd35bd1088e0d7eb92b69d1a8d5b5d76a # 2.8.0
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"
           pattern: "./dist/**/*"
diff --git a/.github/workflows/cleanup-cspell.yml b/.github/workflows/cleanup-cspell.yml
index b4345f666..feab3b11f 100644
--- a/.github/workflows/cleanup-cspell.yml
+++ b/.github/workflows/cleanup-cspell.yml
@@ -17,10 +17,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           cache: "yarn"
 
@@ -33,7 +33,7 @@ jobs:
       - name: Set current date env
         run: echo "CURRENT_DATE=$(date +'%Y-%m-%d')" >> "$GITHUB_ENV"
 
-      - uses: peter-evans/create-pull-request@v7
+      - uses: peter-evans/create-pull-request@271a8d0340265f705b14b6d32b9829c1cb33d45e # v7.0.8
         with:
           commit-message: Cleanup cspell.json (${{ env.CURRENT_DATE }})
           branch: automated-cleanup-cspell-${{ env.CURRENT_DATE }}
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index f1fb7c380..8f122d2f1 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -29,12 +29,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@303c0aef88fc2fe5ff6d63d3b1596bfd83dfa1f9 # v3.30.4
         with:
           config-file: ./.github/codeql/codeql-config.yml
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@303c0aef88fc2fe5ff6d63d3b1596bfd83dfa1f9 # v3.30.4
diff --git a/.github/workflows/dev-package-test.yml b/.github/workflows/dev-package-test.yml
index d5eb4974d..4e0f3ed6f 100644
--- a/.github/workflows/dev-package-test.yml
+++ b/.github/workflows/dev-package-test.yml
@@ -1,4 +1,4 @@
-name: Dev_Package_Test
+name: Dev Package Test
 
 on:
   schedule:
@@ -42,10 +42,10 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: ${{ matrix.node }}
           cache: "yarn"
diff --git a/.github/workflows/dev-test.yml b/.github/workflows/dev-test.yml
index 69cb7cb87..1955b7a6b 100644
--- a/.github/workflows/dev-test.yml
+++ b/.github/workflows/dev-test.yml
@@ -49,10 +49,10 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: ${{ matrix.node }}
           cache: "yarn"
@@ -69,7 +69,7 @@ jobs:
         run: yarn c8 yarn test
 
       - name: Upload Coverage
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@5a1091511ad55cbe89839c7260b706298ca349f7 # v5.5.1
         if: ${{ matrix.ENABLE_CODE_COVERAGE }}
         with:
           fail_ci_if_error: true
diff --git a/.github/workflows/eslint-rules.yml b/.github/workflows/eslint-rules.yml
index b3ef619de..6da165d07 100644
--- a/.github/workflows/eslint-rules.yml
+++ b/.github/workflows/eslint-rules.yml
@@ -1,4 +1,4 @@
-name: Internal_ESLint_Rules_Test
+name: Internal ESLint Plugin Test
 
 on:
   push:
@@ -29,10 +29,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           cache: "yarn"
 
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index d2686258d..81aeb623f 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -21,10 +21,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           cache: "yarn"
 
@@ -67,7 +67,7 @@ jobs:
       - name: Dependency Review
         # Doesn't support push event https://github.com/actions/dependency-review-action/issues/826
         if: github.event_name == 'pull_request'
-        uses: actions/dependency-review-action@v4
+        uses: actions/dependency-review-action@595b5aeba73380359d98a5e087f648dbb0edce1b # v4.7.3
 
       - name: Validate renovate config
         run: npx --package renovate@latest --call renovate-config-validator
diff --git a/.github/workflows/lock.yml b/.github/workflows/lock.yml
index 7cd90919f..993dd1ab7 100644
--- a/.github/workflows/lock.yml
+++ b/.github/workflows/lock.yml
@@ -13,7 +13,7 @@ jobs:
     if: github.event_name != 'schedule' || github.repository == 'prettier/prettier'
     runs-on: ubuntu-latest
     steps:
-      - uses: dessant/lock-threads@v5
+      - uses: dessant/lock-threads@1bf7ec25051fe7c00bdd17e6a7cf3d7bfb7dc771 # v5.0.1
         with:
           # https://github.com/dessant/lock-threads
           github-token: ${{ github.token }}
diff --git a/.github/workflows/mark-issue-duplicate.yml b/.github/workflows/mark-issue-duplicate.yml
index aad4eb1f8..c6dadc52b 100644
--- a/.github/workflows/mark-issue-duplicate.yml
+++ b/.github/workflows/mark-issue-duplicate.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ !github.event.issue.pull_request && startsWith(github.event.comment.body, 'Duplicate of ') }}
     steps:
-      - uses: actions-cool/issues-helper@v3.6.3
+      - uses: actions-cool/issues-helper@45d75b6cf72bf4f254be6230cb887ad002702491 # v3.6.3
         with:
           actions: "mark-duplicate"
           token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/no-response.yml b/.github/workflows/no-response.yml
index e2ce85eac..fca8a0ed3 100644
--- a/.github/workflows/no-response.yml
+++ b/.github/workflows/no-response.yml
@@ -18,7 +18,7 @@ jobs:
     if: github.event_name != 'schedule' || github.repository == 'prettier/prettier'
     runs-on: ubuntu-latest
     steps:
-      - uses: lee-dohm/no-response@v0.5.0
+      - uses: lee-dohm/no-response@9bb0a4b5e6a45046f00353d5de7d90fb8bd773bb # v0.5.0
         with:
           token: ${{ github.token }}
           daysUntilClose: 14
diff --git a/.github/workflows/prevent-file-change.yml b/.github/workflows/prevent-file-change.yml
index aa74b6afb..3e76c3de7 100644
--- a/.github/workflows/prevent-file-change.yml
+++ b/.github/workflows/prevent-file-change.yml
@@ -16,9 +16,9 @@ jobs:
   prevent-add-users:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Prevent file change
-        uses: xalvarez/prevent-file-change-action@v2.0.0
+        uses: xalvarez/prevent-file-change-action@4e88b842aed52bb42b94537ad9736eac06930266 # v2.0.0
         with:
           githubToken: ${{ secrets.GITHUB_TOKEN }}
           pattern: website/data/users.yml
diff --git a/.github/workflows/prod-test.yml b/.github/workflows/prod-test.yml
index 7bbe8bf04..b486424f9 100644
--- a/.github/workflows/prod-test.yml
+++ b/.github/workflows/prod-test.yml
@@ -26,10 +26,10 @@ jobs:
     needs: [build]
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           cache: "yarn"
 
@@ -37,7 +37,7 @@ jobs:
         run: yarn install --immutable
 
       - name: Download Artifact
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
           name: dist
           path: dist
@@ -88,7 +88,7 @@ jobs:
     needs: [build]
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Install yarn@3
         if: ${{ matrix.node == '14' || matrix.node == '16' }}
@@ -98,7 +98,7 @@ jobs:
           cat .yarnrc.yml
 
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: ${{ matrix.node }}
           cache: "yarn"
@@ -117,7 +117,7 @@ jobs:
         run: yarn install --immutable
 
       - name: Download Artifact
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
           name: dist
           path: dist
@@ -144,16 +144,16 @@ jobs:
     needs: [build]
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: "0.10.48"
           package-manager-cache: false
 
       - name: Download Artifact
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
           name: dist
           path: dist
@@ -171,16 +171,16 @@ jobs:
     needs: [build]
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       # `pkg-pr-new` requires Node.js v20
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           node-version: latest
 
       - name: Download Artifact
-        uses: actions/download-artifact@v5
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
           name: dist
           path: dist
diff --git a/.github/workflows/release-script-test.yml b/.github/workflows/release-script-test.yml
index 95a45ec99..5de542ebd 100644
--- a/.github/workflows/release-script-test.yml
+++ b/.github/workflows/release-script-test.yml
@@ -1,4 +1,4 @@
-name: Release_Script_Test
+name: Release Script Test
 
 defaults:
   run:
@@ -31,10 +31,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v5
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 # v5.0.0
         with:
           # Minimal version the release script required
           node-version: "20"
diff --git a/.github/workflows/support.yml b/.github/workflows/support.yml
index 52e0b71ad..d6827aa97 100644
--- a/.github/workflows/support.yml
+++ b/.github/workflows/support.yml
@@ -1,4 +1,4 @@
-name: "Support requests"
+name: Support requests
 
 on:
   issues:
@@ -11,7 +11,7 @@ jobs:
   support:
     runs-on: ubuntu-latest
     steps:
-      - uses: dessant/support-requests@v4.0.0
+      - uses: dessant/support-requests@47d5ea12f6c9e4a081637de9626b7319b415a3bf # v4.0.0
         with:
           github-token: ${{ github.token }}
           support-label: "type:question"