diff --git a/.github/workflows/pr-harness.yaml b/.github/workflows/pr-harness.yaml
new file mode 100644
index 0000000..db09856
--- /dev/null
+++ b/.github/workflows/pr-harness.yaml
@@ -0,0 +1,12 @@
+name: PR Harness
+
+on:
+  pull_request:
+    branches: [main]
+
+jobs:
+  harness:
+    permissions:
+      contents: read
+      pull-requests: read
+    uses: guitarrapc/actions/.github/workflows/pr-harness.yaml@9122a18b0dea07585a242b9eb6ed7886f8587c49 # v1.0.1
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index f17c1a1..6016b02 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -119,7 +119,7 @@ jobs:
         with:
           persist-credentials: false
           ref: ${{ needs.verify.outputs.tag }}
-      - uses: guitarrapc/actions/.github/actions/setup-dotnet@main
+      - uses: guitarrapc/actions/.github/actions/setup-dotnet@9122a18b0dea07585a242b9eb6ed7886f8587c49 # v1.0.1
         with:
           dotnet-version: |
             10.0.x
@@ -171,7 +171,7 @@ jobs:
           sparse-checkout: |
             samples
             scripts
-      - uses: guitarrapc/actions/.github/actions/setup-dotnet@main
+      - uses: guitarrapc/actions/.github/actions/setup-dotnet@9122a18b0dea07585a242b9eb6ed7886f8587c49 # v1.0.1
         with:
           dotnet-version: |
             10.0.x
@@ -233,7 +233,7 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 5
     steps:
-      - uses: guitarrapc/actions/.github/actions/setup-dotnet@main
+      - uses: guitarrapc/actions/.github/actions/setup-dotnet@9122a18b0dea07585a242b9eb6ed7886f8587c49 # v1.0.1
       - name: NuGet login (OIDC → temp API key)
         uses: NuGet/login@8d196754b4036150537f80ac539e15c2f1028841 # v1.2.0
         id: login