diff --git a/.github/workflows/e2e-reset.yml b/.github/workflows/e2e-reset.yml
index 464cb734e..2a8dd03e0 100644
--- a/.github/workflows/e2e-reset.yml
+++ b/.github/workflows/e2e-reset.yml
@@ -35,7 +35,7 @@ jobs:
         uses: namespacelabs/nscloud-checkout-action@0c5e6ce59a41299aba2ad91baa0126f1bfde8e5c # v8
 
       - name: Login to SettleMint and delete workspace
-        uses: settlemint/settlemint-action@main
+        uses: settlemint/settlemint-action@3eb4a628a7136a4d951ba99bda3845e1d6437c97 # main
         if: ${{ env.SETTLEMINT_WORKSPACE != '' }}
         env:
           SETTLEMINT_WORKSPACE: ${{ secrets.SETTLEMINT_WORKSPACE }}
diff --git a/.github/workflows/qa.yml b/.github/workflows/qa.yml
index e4c5dea99..1dd70bb9e 100644
--- a/.github/workflows/qa.yml
+++ b/.github/workflows/qa.yml
@@ -87,7 +87,7 @@ jobs:
         if: |
           github.event_name == 'pull_request' &&
           github.event.pull_request.draft == false
-        uses: settlemint/shared-actions/.github/actions/build-status-labeler@main
+        uses: settlemint/shared-actions/.github/actions/build-status-labeler@e6f1bf8860111910c2ec9538e9edc137f39e8ef1 # main
         with:
           pr_number: ${{ github.event.pull_request.number }}
           workflow_status: "running"
@@ -97,7 +97,7 @@ jobs:
         if: |
           github.event_name == 'pull_request' &&
           github.event.pull_request.draft == false
-        uses: settlemint/shared-actions/.github/actions/slack-pr-notifier@main
+        uses: settlemint/shared-actions/.github/actions/slack-pr-notifier@e6f1bf8860111910c2ec9538e9edc137f39e8ef1 # main
         with:
           pr_number: ${{ github.event.pull_request.number }}
           pr_title: ${{ github.event.pull_request.title }}
@@ -115,7 +115,7 @@ jobs:
           github.event_name == 'pull_request' ||
           github.event_name == 'pull_request_review' ||
           github.event_name == 'release'
-        uses: settlemint/shared-actions/.github/actions/setup-dependencies@main
+        uses: settlemint/shared-actions/.github/actions/setup-dependencies@e6f1bf8860111910c2ec9538e9edc137f39e8ef1 # main
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           runner: github
@@ -252,7 +252,7 @@ jobs:
           always() &&
           github.event_name == 'pull_request' &&
           steps.qa-tests.conclusion != 'skipped'
-        uses: settlemint/shared-actions/.github/actions/build-status-labeler@main
+        uses: settlemint/shared-actions/.github/actions/build-status-labeler@e6f1bf8860111910c2ec9538e9edc137f39e8ef1 # main
         with:
           pr_number: ${{ github.event.pull_request.number }}
           workflow_status:
@@ -266,7 +266,7 @@ jobs:
         if: |
           github.event_name == 'pull_request' &&
           (github.event.action == 'opened' || github.event.action == 'synchronize')
-        uses: settlemint/shared-actions/.github/actions/pr-labeler@main
+        uses: settlemint/shared-actions/.github/actions/pr-labeler@e6f1bf8860111910c2ec9538e9edc137f39e8ef1 # main
         with:
           pr_number: ${{ github.event.pull_request.number }}
           pr_title: ${{ github.event.pull_request.title }}
@@ -278,7 +278,7 @@ jobs:
       - name: Run secret scanning
         id: secret-scan
         if: github.event_name == 'pull_request'
-        uses: settlemint/shared-actions/.github/actions/secret-scanner@main
+        uses: settlemint/shared-actions/.github/actions/secret-scanner@e6f1bf8860111910c2ec9538e9edc137f39e8ef1 # main
         continue-on-error: true
 
       # Label secret scanning results (PR only)
@@ -287,7 +287,7 @@ jobs:
           always() &&
           github.event_name == 'pull_request' &&
           steps.secret-scan.conclusion != 'skipped'
-        uses: settlemint/shared-actions/.github/actions/build-status-labeler@main
+        uses: settlemint/shared-actions/.github/actions/build-status-labeler@e6f1bf8860111910c2ec9538e9edc137f39e8ef1 # main
         with:
           pr_number: ${{ github.event.pull_request.number }}
           workflow_status:
@@ -302,7 +302,7 @@ jobs:
         if: |
           always() &&
           (github.event_name == 'pull_request' || github.event_name == 'pull_request_review')
-        uses: settlemint/shared-actions/.github/actions/pr-review-check@main
+        uses: settlemint/shared-actions/.github/actions/pr-review-check@e6f1bf8860111910c2ec9538e9edc137f39e8ef1 # main
         with:
           pr_number: ${{ github.event.pull_request.number }}
           pr_author: ${{ github.event.pull_request.user.login }}
@@ -316,7 +316,7 @@ jobs:
         if: |
           always() &&
           (github.event_name == 'pull_request' || github.event_name == 'pull_request_review')
-        uses: settlemint/shared-actions/.github/actions/pr-status-labeler@main
+        uses: settlemint/shared-actions/.github/actions/pr-status-labeler@e6f1bf8860111910c2ec9538e9edc137f39e8ef1 # main
         with:
           pr_number: ${{ github.event.pull_request.number }}
           is_draft: ${{ github.event.pull_request.draft }}
@@ -331,7 +331,7 @@ jobs:
           steps.label-final-status.conclusion == 'success' &&
           (github.event_name == 'pull_request' || github.event_name == 'pull_request_review') &&
           github.event.pull_request.draft == false
-        uses: settlemint/shared-actions/.github/actions/slack-pr-notifier@main
+        uses: settlemint/shared-actions/.github/actions/slack-pr-notifier@e6f1bf8860111910c2ec9538e9edc137f39e8ef1 # main
         with:
           pr_number: ${{ github.event.pull_request.number }}
           pr_title: ${{ github.event.pull_request.title }}
@@ -347,7 +347,7 @@ jobs:
         if: |
           always() &&
           (github.event_name == 'pull_request' || github.event_name == 'pull_request_review')
-        uses: settlemint/shared-actions/.github/actions/auto-merge@main
+        uses: settlemint/shared-actions/.github/actions/auto-merge@e6f1bf8860111910c2ec9538e9edc137f39e8ef1 # main
         with:
           pr_number: ${{ github.event.pull_request.number }}
           pr_author: ${{ github.event.pull_request.user.login }}
@@ -393,14 +393,14 @@ jobs:
           SLACK_CHANNEL_ID: op://platform/slack-bot/SLACK_CHANNEL_ID
 
       - name: Label PR as merged
-        uses: settlemint/shared-actions/.github/actions/pr-status-labeler@main
+        uses: settlemint/shared-actions/.github/actions/pr-status-labeler@e6f1bf8860111910c2ec9538e9edc137f39e8ef1 # main
         with:
           pr_number: ${{ github.event.pull_request.number }}
           is_draft: false
           is_merged: true
 
       - name: Update Slack notification for merged PR
-        uses: settlemint/shared-actions/.github/actions/slack-pr-notifier@main
+        uses: settlemint/shared-actions/.github/actions/slack-pr-notifier@e6f1bf8860111910c2ec9538e9edc137f39e8ef1 # main
         with:
           pr_number: ${{ github.event.pull_request.number }}
           pr_title: ${{ github.event.pull_request.title }}
@@ -447,14 +447,14 @@ jobs:
           SLACK_CHANNEL_ID: op://platform/slack-bot/SLACK_CHANNEL_ID
 
       - name: Label PR as abandoned
-        uses: settlemint/shared-actions/.github/actions/pr-status-labeler@main
+        uses: settlemint/shared-actions/.github/actions/pr-status-labeler@e6f1bf8860111910c2ec9538e9edc137f39e8ef1 # main
         with:
           pr_number: ${{ github.event.pull_request.number }}
           is_draft: false
           is_abandoned: true
 
       - name: Update Slack notification for abandoned PR
-        uses: settlemint/shared-actions/.github/actions/slack-pr-notifier@main
+        uses: settlemint/shared-actions/.github/actions/slack-pr-notifier@e6f1bf8860111910c2ec9538e9edc137f39e8ef1 # main
         with:
           pr_number: ${{ github.event.pull_request.number }}
           pr_title: ${{ github.event.pull_request.title }}