diff --git a/.github/workflows/pull-request-check.yml b/.github/workflows/pull-request-check.yml
index 7f7c9e069..ca9aceccc 100644
--- a/.github/workflows/pull-request-check.yml
+++ b/.github/workflows/pull-request-check.yml
@@ -15,10 +15,10 @@ jobs:
         os: [windows-latest, ubuntu-20.04]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Setup JDK
-        uses: graalvm/setup-graalvm@v1
+        uses: graalvm/setup-graalvm@b8dc5fccfbc65b21dd26e8341e7b21c86547f61b # v1
         with:
           java-version: '17.0.8'
           distribution: 'graalvm'
@@ -27,7 +27,7 @@ jobs:
           native-image-job-reports: 'true'
 
       - name: Cache Maven packages
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
@@ -40,7 +40,7 @@ jobs:
         # This seems to be caused by running out of memory; increasing page file
         # size suggested here:
         # https://github.com/actions/virtual-environments/issues/3420#issuecomment-861342418
-        uses: al-cheb/configure-pagefile-action@v1.3
+        uses: al-cheb/configure-pagefile-action@86589fd789a4de3e62ba628dda2cb10027b66d67 # v1.3
         with:
           minimum-size: 32GB
           maximum-size: 32GB
@@ -48,7 +48,7 @@ jobs:
 
       - name: Set Swap Space (Linux)
         if: matrix.os == 'ubuntu-20.04'
-        uses: pierotofy/set-swap-space@master
+        uses: pierotofy/set-swap-space@49819abfb41bd9b44fb781159c033dba90353a7c # master
         with:
           swap-size-gb: 12
 
@@ -63,7 +63,7 @@ jobs:
         shell: bash
 
       - name: Switch to Temurin JDK
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v4
         with:
           distribution: 'temurin'
           java-version: '17'
@@ -78,14 +78,14 @@ jobs:
       - name: Upload executable jar
         # We only need one OS job to upload the jar
         if: matrix.os == 'ubuntu-20.04'
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: samm-cli-jar
           path: tools/samm-cli/target/samm-cli-*.jar
 
       - name: Upload binary (Windows)
         if: matrix.os == 'windows-latest'
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: samm-cli-binary-${{ matrix.os }}
           path: |
@@ -95,7 +95,7 @@ jobs:
 
       - name: Upload binary (Linux/Mac)
         if: matrix.os == 'ubuntu-20.04' || matrix.os == 'macos-latest'
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: samm-cli-binary-${{ matrix.os }}
           path: |
diff --git a/.github/workflows/release-workflow.yml b/.github/workflows/release-workflow.yml
index 34604eeb2..ff35a1e24 100644
--- a/.github/workflows/release-workflow.yml
+++ b/.github/workflows/release-workflow.yml
@@ -11,11 +11,11 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       # Required for Maven
       - name: Set up JDK 17
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v4
         with:
           distribution: 'temurin'
           java-version: '17'
@@ -49,13 +49,13 @@ jobs:
     runs-on: ubuntu-20.04
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       # Even though the build itself is done using the GraalVM JDK
       # (see below), we use the setup-java action to have GPG configured
       # so that it can be used from the maven-gpg-plugin.
       - name: Configure GPG
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v4
         with:
           distribution: 'temurin'
           java-version: '17'
@@ -64,7 +64,7 @@ jobs:
           overwrite-settings: false
 
       - name: Setup JDK
-        uses: graalvm/setup-graalvm@v1
+        uses: graalvm/setup-graalvm@b8dc5fccfbc65b21dd26e8341e7b21c86547f61b # v1
         with:
           java-version: '17.0.8'
           distribution: 'graalvm'
@@ -73,7 +73,7 @@ jobs:
           native-image-job-reports: 'true'
 
       - name: Cache Maven packages
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
@@ -81,7 +81,7 @@ jobs:
             ${{ runner.os }}-maven-
 
       - name: Set Swap Space (Linux)
-        uses: pierotofy/set-swap-space@master
+        uses: pierotofy/set-swap-space@49819abfb41bd9b44fb781159c033dba90353a7c # master
         with:
           swap-size-gb: 12
 
@@ -116,7 +116,7 @@ jobs:
           PGP_KEY_PASSWORD: ${{ secrets.PGP_KEY_PASSWORD }}
 
       - name: Switch to Temurin JDK
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v4
         with:
           distribution: 'temurin'
           java-version: '17'
@@ -128,7 +128,7 @@ jobs:
           mvn -B -Denforcer.skip -Dskip.maven.surefire failsafe:integration-test -Dmaven.wagon.httpconnectionManager.ttlSeconds=60
 
       - name: Upload staging directory and Linux binary
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: linux-artifacts
           path: |
@@ -147,10 +147,10 @@ jobs:
     runs-on: windows-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       - name: Setup JDK
-        uses: graalvm/setup-graalvm@v1
+        uses: graalvm/setup-graalvm@b8dc5fccfbc65b21dd26e8341e7b21c86547f61b # v1
         with:
           java-version: '17.0.8'
           distribution: 'graalvm'
@@ -159,7 +159,7 @@ jobs:
           native-image-job-reports: 'true'
 
       - name: Cache Maven packages
-        uses: actions/cache@v3
+        uses: actions/cache@v4
         with:
           path: ~/.m2/repository
           key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
@@ -171,7 +171,7 @@ jobs:
         # This seems to be caused by running out of memory; increasing page file
         # size suggested here:
         # https://github.com/actions/virtual-environments/issues/3420#issuecomment-861342418
-        uses: al-cheb/configure-pagefile-action@v1.3
+        uses: al-cheb/configure-pagefile-action@86589fd789a4de3e62ba628dda2cb10027b66d67 # v1.3
         with:
           minimum-size: 32GB
           maximum-size: 32GB
@@ -194,7 +194,7 @@ jobs:
         shell: bash
 
       - name: Upload Windows binary
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
           name: windows-artifacts
           path: |
@@ -210,11 +210,11 @@ jobs:
       # Need to checkout here too, so that we have the pom.xml
       # with the deployment info available
       - name: Checkout
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
 
       # Required to have Maven settings.xml set up correctly
       - name: Set up JDK 17
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@v4
         with:
           distribution: 'temurin'
           java-version: '17'
@@ -226,7 +226,7 @@ jobs:
       # Required to run the mvn:versions, since enforcer plugin
       # will check for GraalVM JDK
       - name: Setup JDK
-        uses: graalvm/setup-graalvm@v1
+        uses: graalvm/setup-graalvm@b8dc5fccfbc65b21dd26e8341e7b21c86547f61b # v1
         with:
           java-version: '17.0.8'
           distribution: 'graalvm'
@@ -235,12 +235,12 @@ jobs:
           native-image-job-reports: 'false'
 
       - name: Fetch Linux Artifacts
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: linux-artifacts
 
       - name: Fetch Windows Artifacts
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
           name: windows-artifacts
 
@@ -287,7 +287,7 @@ jobs:
           yq eval -i '.version = "${{ github.event.inputs.release_version }}"' documentation/developer-guide/antora.yml
 
       - name: Commit version changes and push to upstream repository
-        uses: stefanzweifel/git-auto-commit-action@v4
+        uses: stefanzweifel/git-auto-commit-action@8756aa072ef5b4a080af5dc8fef36c5d586e521d # v5
         with:
            branch: ${{ env.release_branch_name }}
            commit_user_name: github-actions
@@ -298,7 +298,7 @@ jobs:
       # Full release: Github
       - name: "Create Github release (full)"
         if: ${{ !contains( github.event.inputs.release_version, '-M' ) }}
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844v1 # v0.1.15
         id: esmf_sdk_release
         with:
           body: "Release version ${{ github.event.inputs.release_version }}."
@@ -315,7 +315,7 @@ jobs:
 
       - name: "Notify issues of release their fix is contained in"
         if: ${{ !contains( github.event.inputs.release_version, '-M' ) }}
-        uses: apexskier/github-release-commenter@v1
+        uses: apexskier/github-release-commenter@3bd413ad5e1d603bfe2282f9f06f2bdcec079327 # v1.3.6
         with:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           comment-template: |
@@ -324,7 +324,7 @@ jobs:
       # Milestone release: Write settings to deploy to Github repo
       - name: Write settings.xml
         if: contains( github.event.inputs.release_version, '-M' )
-        uses: DamianReeves/write-file-action@v1.0
+        uses: DamianReeves/write-file-action@0a7fcbe1960c53fc08fe789fa4850d24885f4d84 # v1.2
         with:
           path: settings.xml
           contents: |
@@ -363,8 +363,8 @@ jobs:
       # Milestone release: Github
       - name: "Create Github release (milestone)"
         if: contains( github.event.inputs.release_version, '-M' )
-        uses: softprops/action-gh-release@v1
-        id: sds_sdk_release
+        uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844v1 # v0.1.15
+        id: esmf_sdk_release
         with:
           body: "Release version ${{ github.event.inputs.release_version }}."
           tag_name: v${{ github.event.inputs.release_version }}