diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index bcb3c180..467c1975 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -4,7 +4,11 @@ updates:
     directory: /
     schedule:
       interval: "monthly"
+    cooldown:
+      default-days: 7
   - package-ecosystem: "composer"
     directory: /
     schedule:
       interval: "monthly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/build-and-push-docker-image.yml b/.github/workflows/build-and-push-docker-image.yml
index aad1ed4d..cfce8b29 100644
--- a/.github/workflows/build-and-push-docker-image.yml
+++ b/.github/workflows/build-and-push-docker-image.yml
@@ -42,10 +42,12 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
+        with:
+          persist-credentials: false
 
       - name: Fetch built PHAR from artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
         with:
           name: pie-${{ github.sha }}.phar
 
@@ -55,13 +57,13 @@ jobs:
         run: gh attestation verify pie.phar --repo ${{ github.repository }}
 
       - name: Set up QEMU
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@06116385d9baf250c9f4dcb4858b16962ea869c3 #v4.1.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 #v4.1.0
 
       - name: Log in to the Container registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@650006c6eb7dba73a995cc03b0b2d7f5ca915bee #v4.2.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -69,7 +71,7 @@ jobs:
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 #v6.1.0
         with:
           flavor: |
             latest=false
@@ -79,7 +81,7 @@ jobs:
 
       - name: Build and push Docker image
         id: build-and-push
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf #v7.2.0
         with:
           context: .
           platforms: linux/amd64,linux/arm64
@@ -90,7 +92,7 @@ jobs:
           labels: ${{ steps.meta.outputs.labels }}
 
       - name: Generate artifact attestation
-        uses: actions/attest@v4
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 #v4.1.0
         with:
           subject-name: ghcr.io/${{ github.repository }}
           subject-digest: ${{ steps.build-and-push.outputs.digest }}
diff --git a/.github/workflows/build-assets.yml b/.github/workflows/build-assets.yml
index 41503677..b1e3b303 100644
--- a/.github/workflows/build-assets.yml
+++ b/.github/workflows/build-assets.yml
@@ -33,19 +33,20 @@ jobs:
       attestations: write
     steps:
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 #2.37.2
         with:
           coverage: none
           tools: composer, box:4.7.x
           php-version: "${{ matrix.php-version }}"
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
         with:
           fetch-depth: 0
+          persist-credentials: false
       # Fixes `git describe` picking the wrong tag - see https://github.com/php/pie/issues/307
       - run: git fetch --tags --force
       # Ensure some kind of previous tag exists, otherwise box fails
       - run: git describe --tags HEAD || git tag 0.0.0
-      - uses: ramsey/composer-install@v4
+      - uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda #4.0.0
       - name: Build PHAR
         run: box compile
       - name: Check the PHAR executes
@@ -57,10 +58,10 @@ jobs:
         # code, which would store attestation that `php/pie` built the PHAR, and
         # it would look genuine. So this should NOT run for PR builds.
         if: github.event_name != 'pull_request' && github.event.repository.visibility == 'public'
-        uses: actions/attest@v4
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 #v4.1.0
         with:
           subject-path: '${{ github.workspace }}/pie.phar'
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
         with:
           name: pie-${{ github.sha }}.phar
           path: pie.phar
@@ -87,7 +88,9 @@ jobs:
       # attestations:write is required for build provenance attestation.
       attestations: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
+        with:
+          persist-credentials: false
 
       - name: Download SPC (non-Windows)
         if: runner.os != 'Windows'
@@ -129,28 +132,37 @@ jobs:
           echo "PIE_BINARY_OUTPUT=pie-${{ runner.os }}-${{ runner.arch }}.exe" >> $env:GITHUB_ENV
 
       - name: Check SPC version
-        run: ${{ env.SPC_BINARY }} --version
+        env:
+          SPC_BINARY: ${{ env.SPC_BINARY }}
+        run: ${SPC_BINARY} --version
 
       - name: Grab the pie.phar from artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
         with:
           name: pie-${{ github.sha }}.phar
 
       - name: Build for ${{ runner.os }} ${{ runner.arch }} on ${{ matrix.operating-system }}
-        run: ${{ env.SPC_BINARY }} craft resources/spc/craft.yml
+        run: ${SPC_BINARY} craft resources/spc/craft.yml
         env:
+          SPC_BINARY: ${{ env.SPC_BINARY }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
       - name: Bundle pie.phar into executable PIE binary
-        run: ${{ env.SPC_BINARY }} micro:combine pie.phar --output=${{ env.PIE_BINARY_OUTPUT }}
+        env:
+          PIE_BINARY_OUTPUT: ${{ env.PIE_BINARY_OUTPUT }}
+          SPC_BINARY: ${{ env.SPC_BINARY }}
+        run: ${SPC_BINARY} micro:combine pie.phar --output=${PIE_BINARY_OUTPUT}
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 #2.37.2
         with:
           coverage: none
           tools: composer
           php-version: "7.4"
       - name: Quick validation that the binary runs
-        run: ./${{ env.PIE_BINARY_OUTPUT }} show --all
+        env:
+          PIE_BINARY_OUTPUT: ${{ env.PIE_BINARY_OUTPUT }}
+        run: ./${PIE_BINARY_OUTPUT} show --all
 
       - name: Generate build provenance attestation
         # It does not make sense to do this for PR builds, nor do contributors
@@ -159,11 +171,11 @@ jobs:
         # code, which would store attestation that `php/pie` built the binaries,
         # and it would look genuine. So this should NOT run for PR builds.
         if: github.event_name != 'pull_request' && github.event.repository.visibility == 'public'
-        uses: actions/attest@v4
+        uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 #v4.1.0
         with:
-          subject-path: '${{ github.workspace }}/${{ env.PIE_BINARY_OUTPUT }}'
+          subject-path: ${{ github.workspace }}/${{ env.PIE_BINARY_OUTPUT }}
 
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a #v7.0.1
         with:
           name: pie-${{ github.sha }}-${{ runner.os }}-${{ runner.arch }}.bin
           path: ${{ env.PIE_BINARY_OUTPUT }}
diff --git a/.github/workflows/continuous-integration.yml b/.github/workflows/continuous-integration.yml
index 6405a8f0..22391281 100644
--- a/.github/workflows/continuous-integration.yml
+++ b/.github/workflows/continuous-integration.yml
@@ -23,14 +23,16 @@ jobs:
           - '8.5'
     steps:
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 #2.37.2
         with:
           php-version: ${{ matrix.php-versions }}
           extensions: intl, sodium, zip
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - uses: actions/checkout@v6
-      - uses: ramsey/composer-install@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
+        with:
+          persist-credentials: false
+      - uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda #4.0.0
       - name: GH token (non-Windows)
         if: matrix.operating-system != 'windows-latest'
         run: sudo composer config --global --auth github-oauth.github.com ${{ secrets.GITHUB_TOKEN }}
@@ -102,12 +104,14 @@ jobs:
           DIST_URL=`curl -fsSL "https://www.php.net/releases/index.php?json&max=1&version=${{ matrix.php-versions }}" | jq -r '.[].source[]|select(.filename|endswith(".gz")).filename'`
           echo "php_src_download_url=https://www.php.net/distributions/$DIST_URL" >> $GITHUB_ENV
       - name: "Install PHP ${{ matrix.php-versions }}"
+        env:
+          php_src_download_url: ${{ env.php_src_download_url }}
         run: |
           mkdir -p /tmp/php
           mkdir -p /tmp/php.ini.d
           cd /tmp/php
-          echo "Downloading release from ${{ env.php_src_download_url }} ..."
-          wget -O php.tgz ${{ env.php_src_download_url }}
+          echo "Downloading release from ${php_src_download_url} ..."
+          wget -O php.tgz ${php_src_download_url}
           tar zxf php.tgz
           rm php.tgz
           ls -l
@@ -118,7 +122,9 @@ jobs:
           make -j$(nproc)
           sudo make install
           cd $GITHUB_WORKSPACE
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
+        with:
+          persist-credentials: false
       - name: Composer Install
         run: composer install --ignore-platform-reqs
       - name: Run bundled PHP install test
@@ -129,14 +135,15 @@ jobs:
   end-to-end-tests:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
         with:
           fetch-depth: 0
+          persist-credentials: false
       # Fixes `git describe` picking the wrong tag - see https://github.com/php/pie/issues/307
       - run: git fetch --tags --force
       # Ensure some kind of previous tag exists, otherwise box fails
       - run: git describe --tags HEAD || git tag 0.0.0
-      - uses: ramsey/composer-install@v4
+      - uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda #4.0.0
       - name: Run the tests
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -154,14 +161,15 @@ jobs:
           - '8.3'
           - '8.4'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
         with:
           fetch-depth: 0
+          persist-credentials: false
       # Fixes `git describe` picking the wrong tag - see https://github.com/php/pie/issues/307
       - run: git fetch --tags --force
       # Ensure some kind of previous tag exists, otherwise box fails
       - run: git describe --tags HEAD || git tag 0.0.0
-      - uses: ramsey/composer-install@v4
+      - uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda #4.0.0
       - name: Build
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -175,14 +183,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 #2.37.2
         with:
           php-version: 8.1
           extensions: intl, sodium, zip
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - uses: actions/checkout@v6
-      - uses: ramsey/composer-install@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
+        with:
+          persist-credentials: false
+      - uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda #4.0.0
       - name: Run PHPCS
         run: vendor/bin/phpcs
 
@@ -190,14 +200,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 #2.37.2
         with:
           php-version: 8.5
           extensions: intl, sodium, zip
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - uses: actions/checkout@v6
-      - uses: ramsey/composer-install@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
+        with:
+          persist-credentials: false
+      - uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda #4.0.0
       - name: Validate the composer configuration
         run: composer validate --strict
       - name: Run phpstan
@@ -207,20 +219,32 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 #2.37.2
         with:
           php-version: 8.4
           extensions: intl, sodium, zip
           tools: infection
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - uses: actions/checkout@v6
-      - uses: ramsey/composer-install@v4
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
+        with:
+          persist-credentials: false
+      - uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda #4.0.0
       - name: Run infection
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: sudo infection --min-msi=68 --min-covered-msi=68 --threads=max --show-mutations=max --no-progress
 
+  zizmor:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
+        with:
+          persist-credentials: false
+      - uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d #v0.5.6
+        with:
+          advanced-security: false
+
   build-assets:
     needs:
       - unit-tests
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 338db80e..bc00fc51 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -33,15 +33,17 @@ jobs:
       - build-assets
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
+        with:
+          persist-credentials: false
       - name: Build documentation
         run: .github/docs/build-docs.sh
       - name: Fetch built PHAR from artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
         with:
           name: pie-${{ github.sha }}.phar
       - name: Fetch the executable PIEs from artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
         with:
           path: executable-pie-binaries
           pattern: pie-${{ github.sha }}-*.bin
@@ -57,7 +59,7 @@ jobs:
       - name: Copy executables into docs
         run: cp executable-pie-binaries/* docs-package/
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 #v5.0.0
         with:
           path: docs-package
 
@@ -77,4 +79,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 #v5.0.0
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5c6aceb8..2596921d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -25,10 +25,11 @@ jobs:
       # contents:write is required to create the draft release
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
         with:
           fetch-tags: 'true'
           ref: ${{ github.ref }}
+          persist-credentials: false
       # The changelog is generated locally using jwage/changelog-generator and
       # that forms the signed tag body. The `--notes-from-tag` option below
       # will copy the release notes from the tag so it will contain the changelog
@@ -37,7 +38,7 @@ jobs:
       - name: Create draft release from tag
         env:
           GH_TOKEN: ${{ github.token }}
-        run: gh release create "${{ github.ref_name }}" --title "${{ github.ref_name }}" --draft --notes-from-tag
+        run: gh release create "${GITHUB_REF_NAME}" --title "${GITHUB_REF_NAME}" --draft --notes-from-tag
 
   attach-release-assets:
     runs-on: ubuntu-latest
@@ -47,13 +48,15 @@ jobs:
       # contents:write is required to upload the binaries to the release.
       contents: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 #v6.0.3
+        with:
+          persist-credentials: false
       - name: Fetch built PHAR from artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
         with:
           name: pie-${{ github.sha }}.phar
       - name: Fetch the executable PIEs from artifacts
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
         with:
           path: executable-pie-binaries
           pattern: pie-${{ github.sha }}-*.bin
@@ -73,8 +76,8 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: |
-          gh release upload "${{ github.ref_name }}" "pie.phar" --clobber ;
-          find executable-pie-binaries -type f -exec gh release upload "${{ github.ref_name }}" {} --clobber \;
+          gh release upload "${GITHUB_REF_NAME}" "pie.phar" --clobber ;
+          find executable-pie-binaries -type f -exec gh release upload "${GITHUB_REF_NAME}" {} --clobber \;
 
   build-and-push-docker-image:
     if: ${{ startsWith(github.ref, 'refs/tags/') }}