diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 14eabd9..96f2b2e 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0
       - name: Enforce repository tracked-path boundary
@@ -421,10 +421,10 @@ jobs:
         working-directory: workbench
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Set up Node 22
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: '22'
           cache: 'npm'
@@ -453,10 +453,10 @@ jobs:
         working-directory: packages/redaction-core
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Set up Node 22
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: '22'
           cache: 'npm'
@@ -487,10 +487,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Set up Python 3.12
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: '3.12'
 
@@ -531,10 +531,12 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 
       - name: Set up Rust (stable)
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # master; toolchain via input
+        with:
+          toolchain: stable
 
       # Tauri v2 links against system webkit/gtk; the src-tauri crate needs them present to compile its tests.
       - name: Install Tauri system deps
diff --git a/deploy/test_repository_profiles.py b/deploy/test_repository_profiles.py
index 4694e84..3d05e5d 100644
--- a/deploy/test_repository_profiles.py
+++ b/deploy/test_repository_profiles.py
@@ -1368,7 +1368,7 @@ def test_repo_hygiene_checkout_fetches_full_history():
     checkouts = [
         step
         for step in steps
-        if isinstance(step, dict) and step.get("uses") == "actions/checkout@v4"
+        if isinstance(step, dict) and isinstance(step.get("uses"), str) and str(step.get("uses")).split("#")[0].strip().startswith("actions/checkout@")
     ]
 
     assert len(checkouts) == 1, "repo-hygiene must have exactly one checkout"