diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c9924c3..0a63670 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,16 +17,20 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
     - name: Install Rust toolchain
-      uses: dtolnay/rust-toolchain@stable
+      uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+      with:
+        toolchain: stable
 
     - name: Set up compilation cache (sccache)
-      uses: mozilla-actions/sccache-action@v0.0.9
+      uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9
 
     - name: Install nextest
-      uses: taiki-e/install-action@nextest
+      uses: taiki-e/install-action@e32179aa3c2a47939bd07439bd80ddf13f99979f # nextest
+      with:
+        tool: nextest
 
     - name: Run tests
       run: cargo ci-test
@@ -35,15 +39,16 @@ jobs:
     name: Format Check
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
     - name: Install Rust toolchain
-      uses: dtolnay/rust-toolchain@stable
+      uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
       with:
+        toolchain: stable
         components: rustfmt
 
     - name: Set up compilation cache (sccache)
-      uses: mozilla-actions/sccache-action@v0.0.9
+      uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9
 
     - name: Check formatting
       run: cargo ci-fmt
@@ -52,15 +57,16 @@ jobs:
     name: Lint Check
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
     - name: Install Rust toolchain
-      uses: dtolnay/rust-toolchain@stable
+      uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
       with:
+        toolchain: stable
         components: clippy
 
     - name: Set up compilation cache (sccache)
-      uses: mozilla-actions/sccache-action@v0.0.9
+      uses: mozilla-actions/sccache-action@7d986dd989559c6ecdb630a3fd2557667be217ad # v0.0.9
 
     - name: Run clippy
       run: cargo ci-lint
\ No newline at end of file
diff --git a/.github/workflows/deploy-local.yml b/.github/workflows/deploy-local.yml
index e103de1..a5e8f2b 100644
--- a/.github/workflows/deploy-local.yml
+++ b/.github/workflows/deploy-local.yml
@@ -20,7 +20,7 @@ jobs:
   build-and-deploy:
     runs-on: [self-hosted, linux, x64, ref-solver-deploy]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Setup Rust
         run: |
@@ -30,7 +30,7 @@ jobs:
           echo "$HOME/.cargo/bin" >> $GITHUB_PATH
 
       - name: Cache cargo registry
-        uses: actions/cache@v4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         with:
           path: |
             ~/.cargo/registry
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index f149147..8e7d115 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -14,14 +14,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: 0
           token: ${{ secrets.RELEASE_PLZ_TOKEN }}
       - name: Install Rust toolchain
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+        with:
+          toolchain: stable
       - name: Run release-plz
-        uses: MarcoIeni/release-plz-action@v0.5
+        uses: MarcoIeni/release-plz-action@1528104d2ca23787631a1c1f022abb64b34c1e11 # v0.5
         env:
           GITHUB_TOKEN: ${{ secrets.RELEASE_PLZ_TOKEN }}
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
diff --git a/src/catalog/builder.rs b/src/catalog/builder.rs
index 2d8769b..06ed703 100644
--- a/src/catalog/builder.rs
+++ b/src/catalog/builder.rs
@@ -987,13 +987,7 @@ impl std::fmt::Display for BuildSummary {
         writeln!(f)?;
 
         writeln!(f, "Coverage:")?;
-        let pct = |n: usize, total: usize| {
-            if total == 0 {
-                0
-            } else {
-                (n * 100) / total
-            }
-        };
+        let pct = |n: usize, total: usize| (n * 100).checked_div(total).unwrap_or(0);
         let check = |n: usize, total: usize| {
             if n == total {
                 "+"
diff --git a/src/catalog/index.rs b/src/catalog/index.rs
index 1106169..54046f1 100644
--- a/src/catalog/index.rs
+++ b/src/catalog/index.rs
@@ -30,7 +30,7 @@ impl<'a> CandidateFinder<'a> {
         }
 
         let mut candidates: Vec<_> = ref_counts.into_iter().collect();
-        candidates.sort_by(|a, b| b.1.cmp(&a.1)); // Sort by count descending
+        candidates.sort_by_key(|b| std::cmp::Reverse(b.1)); // Sort by count descending
         candidates
     }
 
@@ -68,7 +68,7 @@ impl<'a> CandidateFinder<'a> {
         }
 
         let mut candidates: Vec<_> = ref_counts.into_iter().collect();
-        candidates.sort_by(|a, b| b.1.cmp(&a.1));
+        candidates.sort_by_key(|b| std::cmp::Reverse(b.1));
         candidates
     }