diff --git a/.github/workflows/ai-platform-snippets.yaml b/.github/workflows/ai-platform-snippets.yaml
index 861530a438..8fd3cd670d 100644
--- a/.github/workflows/ai-platform-snippets.yaml
+++ b/.github/workflows/ai-platform-snippets.yaml
@@ -62,7 +62,7 @@ jobs:
       id: npm-cache-dir
       shell: bash
       run: echo "dir=$(npm config get cache)" >> ${GITHUB_OUTPUT}
-    - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4
+    - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
       id: npm-cache
       with:
         path: ${{ steps.npm-cache-dir.outputs.dir }}
@@ -82,7 +82,7 @@ jobs:
         CAIP_PROJECT_ID: ${{ steps.secrets.outputs.caip_id }}
     - name: upload test results for FlakyBot workflow
       if: github.event.action == 'schedule' && always()
-      uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       env:
         MOCHA_REPORTER_OUTPUT: "${{github.run_id}}_sponge_log.xml"
       with:
diff --git a/.github/workflows/ci-scripts.yaml b/.github/workflows/ci-scripts.yaml
index ad8107e135..6417fcbd44 100644
--- a/.github/workflows/ci-scripts.yaml
+++ b/.github/workflows/ci-scripts.yaml
@@ -31,7 +31,7 @@ jobs:
         working-directory: .github/scripts
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-      - uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 20
       - run: npm install
diff --git a/.github/workflows/custard-ci-dev.yaml b/.github/workflows/custard-ci-dev.yaml
index e309fa73d9..d597e55c42 100644
--- a/.github/workflows/custard-ci-dev.yaml
+++ b/.github/workflows/custard-ci-dev.yaml
@@ -45,7 +45,7 @@ jobs:
       - name: Create `bin` directory for cloud-samples-tools binaries
         run: mkdir bin
         working-directory: cloud-samples-tools
-      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5
+      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5
         with:
           go-version: ${{ env.GO_VERSION }}
       - name: Build Custard (from cloud-samples-tools)
@@ -81,7 +81,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           ref: ${{ github.event.pull_request.head.sha }}
-      - uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: ${{ fromJson(env.CI_SETUP).node-version }}
       - uses: google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f # v2
diff --git a/.github/workflows/custard-ci.yaml b/.github/workflows/custard-ci.yaml
index 27ff2ed57e..177a942092 100644
--- a/.github/workflows/custard-ci.yaml
+++ b/.github/workflows/custard-ci.yaml
@@ -46,7 +46,7 @@ jobs:
       - name: Create `bin` directory for cloud-samples-tools binaries
         run: mkdir bin
         working-directory: cloud-samples-tools
-      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5
+      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5
         with:
           go-version: ${{ env.GO_VERSION }}
       - name: Build Custard (from cloud-samples-tools)
@@ -69,7 +69,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - name: Setup Node
-        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 20
       - run: npm install
@@ -113,7 +113,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
-      - uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 20
       - run: ./.github/workflows/utils/region-tags-tests.sh
@@ -138,7 +138,7 @@ jobs:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           ref: ${{ github.event.pull_request.head.sha }}
-      - uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: ${{ fromJson(env.CI_SETUP).node-version }}
       - uses: google-github-actions/auth@6fc4af4b145ae7821d527454aa9bd537d1f2dc5f # v2
diff --git a/.github/workflows/custard-run-dev.yaml b/.github/workflows/custard-run-dev.yaml
index 24b8787235..aba2ea6649 100644
--- a/.github/workflows/custard-run-dev.yaml
+++ b/.github/workflows/custard-run-dev.yaml
@@ -45,7 +45,7 @@ on:
 
 jobs:
   affected:
-    uses: GoogleCloudPlatform/cloud-samples-tools/.github/workflows/affected.yaml@v0.2.3
+    uses: GoogleCloudPlatform/cloud-samples-tools/.github/workflows/affected.yaml@967334777b636ec212c32bf60e69b6635971b593 # v0.2.3
     permissions:
       statuses: write
     with:
@@ -73,7 +73,7 @@ jobs:
       GOOGLE_SERVICE_ACCOUNT: kokoro-system-test@long-door-651.iam.gserviceaccount.com
     steps:
       - name: Check queued
-        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/create-check@v0.2.3
+        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/create-check@967334777b636ec212c32bf60e69b6635971b593 # v0.2.3
         id: queued
         with:
           sha: ${{ github.event.workflow_run.head_sha || inputs.ref || github.sha }}
@@ -81,7 +81,7 @@ jobs:
           job-name: ${{ github.job }} (${{ matrix.path }})
           if: ${{ !!github.event.workflow_run }}
       - name: Setup Custard
-        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/setup-custard@v0.2.3
+        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/setup-custard@967334777b636ec212c32bf60e69b6635971b593 # v0.2.3
         with:
           path: ${{ matrix.path }}
           ci-setup: ${{ toJson(fromJson(needs.affected.outputs.ci-setups)[matrix.path]) }}
@@ -89,7 +89,7 @@ jobs:
           workload-identity-provider: projects/1046198160504/locations/global/workloadIdentityPools/github-actions-pool/providers/github-actions-provider
           service-account: ${{ env.GOOGLE_SERVICE_ACCOUNT }}
       - name: Check in_progress
-        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@v0.2.3
+        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@967334777b636ec212c32bf60e69b6635971b593 # v0.2.3
         id: in_progress
         with:
           check: ${{ steps.queued.outputs.check }}
@@ -99,12 +99,12 @@ jobs:
           timeout ${{ fromJson(needs.affected.outputs.ci-setups)[matrix.path].timeout-minutes }}m \
             make test dir=${{ matrix.path }}
       - name: Check success
-        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@v0.2.3
+        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@967334777b636ec212c32bf60e69b6635971b593 # v0.2.3
         with:
           check: ${{ steps.in_progress.outputs.check }}
           status: success
       - name: Check failure
-        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@v0.2.3
+        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@967334777b636ec212c32bf60e69b6635971b593 # v0.2.3
         if: failure()
         with:
           check: ${{ steps.in_progress.outputs.check }}
@@ -118,7 +118,7 @@ jobs:
       statuses: write
     steps:
       - name: Check success
-        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@v0.2.3
+        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@967334777b636ec212c32bf60e69b6635971b593 # v0.2.3
         with:
           check: ${{ needs.affected.outputs.check }}
           status: success
diff --git a/.github/workflows/custard-run.yaml b/.github/workflows/custard-run.yaml
index 476a0d8020..f71862feec 100644
--- a/.github/workflows/custard-run.yaml
+++ b/.github/workflows/custard-run.yaml
@@ -50,7 +50,7 @@ on:
 
 jobs:
   affected:
-    uses: GoogleCloudPlatform/cloud-samples-tools/.github/workflows/affected.yaml@v0.2.3
+    uses: GoogleCloudPlatform/cloud-samples-tools/.github/workflows/affected.yaml@967334777b636ec212c32bf60e69b6635971b593 # v0.2.3
     permissions:
       statuses: write
     with:
@@ -68,7 +68,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Check in_progress
-        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/create-check@v0.2.3
+        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/create-check@967334777b636ec212c32bf60e69b6635971b593 # v0.2.3
         id: in_progress
         with:
           sha: ${{ github.event.workflow_run.head_sha || inputs.ref || github.sha }}
@@ -78,22 +78,22 @@ jobs:
       - name: Checkout
         uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
       - name: Setup Node
-        uses: actions/setup-node@1d0ff469b7ec7b3cb9d8673fde0c81c44821de2a # v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
         with:
           node-version: 20
       - run: npm install
       - name: npx gtx lint (${{ needs.affected.outputs.num-paths }} packages)
-        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/map-run@v0.2.3
+        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/map-run@967334777b636ec212c32bf60e69b6635971b593 # v0.2.3
         with:
           command: npx gts lint
           paths: ${{ needs.affected.outputs.paths }}
       - name: Check success
-        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@v0.2.3
+        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@967334777b636ec212c32bf60e69b6635971b593 # v0.2.3
         with:
           check: ${{ steps.in_progress.outputs.check }}
           status: success
       - name: Check failure
-        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@v0.2.3
+        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@967334777b636ec212c32bf60e69b6635971b593 # v0.2.3
         if: failure()
         with:
           check: ${{ steps.in_progress.outputs.check }}
@@ -117,7 +117,7 @@ jobs:
       GOOGLE_SERVICE_ACCOUNT: kokoro-system-test@long-door-651.iam.gserviceaccount.com
     steps:
       - name: Check queued
-        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/create-check@v0.2.3
+        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/create-check@967334777b636ec212c32bf60e69b6635971b593 # v0.2.3
         id: queued
         with:
           sha: ${{ github.event.workflow_run.head_sha || inputs.ref || github.sha }}
@@ -125,7 +125,7 @@ jobs:
           job-name: ${{ github.job }} (${{ matrix.path }})
           if: ${{ !!github.event.workflow_run }}
       - name: Setup Custard
-        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/setup-custard@v0.2.3
+        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/setup-custard@967334777b636ec212c32bf60e69b6635971b593 # v0.2.3
         with:
           path: ${{ matrix.path }}
           ci-setup: ${{ toJson(fromJson(needs.affected.outputs.ci-setups)[matrix.path]) }}
@@ -133,7 +133,7 @@ jobs:
           workload-identity-provider: projects/1046198160504/locations/global/workloadIdentityPools/github-actions-pool/providers/github-actions-provider
           service-account: ${{ env.GOOGLE_SERVICE_ACCOUNT }}
       - name: Check in_progress
-        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@v0.2.3
+        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@967334777b636ec212c32bf60e69b6635971b593 # v0.2.3
         id: in_progress
         with:
           check: ${{ steps.queued.outputs.check }}
@@ -143,12 +143,12 @@ jobs:
           timeout ${{ fromJson(needs.affected.outputs.ci-setups)[matrix.path].timeout-minutes }}m \
             make test dir=${{ matrix.path }}
       - name: Check success
-        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@v0.2.3
+        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@967334777b636ec212c32bf60e69b6635971b593 # v0.2.3
         with:
           check: ${{ steps.in_progress.outputs.check }}
           status: success
       - name: Check failure
-        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@v0.2.3
+        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@967334777b636ec212c32bf60e69b6635971b593 # v0.2.3
         if: failure()
         with:
           check: ${{ steps.in_progress.outputs.check }}
@@ -162,7 +162,7 @@ jobs:
       statuses: write
     steps:
       - name: Check success
-        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@v0.2.3
+        uses: GoogleCloudPlatform/cloud-samples-tools/actions/steps/update-check@967334777b636ec212c32bf60e69b6635971b593 # v0.2.3
         with:
           check: ${{ needs.affected.outputs.check }}
           status: success
diff --git a/.github/workflows/dialogflow-cx.yaml b/.github/workflows/dialogflow-cx.yaml
index 7716070d5e..af31747cf9 100644
--- a/.github/workflows/dialogflow-cx.yaml
+++ b/.github/workflows/dialogflow-cx.yaml
@@ -62,7 +62,7 @@ jobs:
       id: npm-cache-dir
       shell: bash
       run: echo "dir=$(npm config get cache)" >> ${GITHUB_OUTPUT}
-    - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4
+    - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
       id: npm-cache
       with:
         path: ${{ steps.npm-cache-dir.outputs.dir }}
@@ -84,7 +84,7 @@ jobs:
         AGENT_PROJECT_ID: nodejs-docs-samples-tests
     - name: upload test results for FlakyBot workflow
       if: github.event.action == 'schedule' && always()
-      uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       env:
         MOCHA_REPORTER_OUTPUT: "${{github.run_id}}_sponge_log.xml"
       with:
diff --git a/.github/workflows/functions-slack.yaml b/.github/workflows/functions-slack.yaml
index 289fe993bb..7e32c75185 100644
--- a/.github/workflows/functions-slack.yaml
+++ b/.github/workflows/functions-slack.yaml
@@ -62,7 +62,7 @@ jobs:
       id: npm-cache-dir
       shell: bash
       run: echo "dir=$(npm config get cache)" >> ${GITHUB_OUTPUT}
-    - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4
+    - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
       id: npm-cache
       with:
           path: ${{ steps.npm-cache-dir.outputs.dir }}
@@ -83,7 +83,7 @@ jobs:
           KG_API_KEY: ${{ steps.secrets.outputs.kg_api_key }}
     - name: upload test results for FlakyBot workflow
       if: github.event.action == 'schedule' && always()
-      uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       env:
           MOCHA_REPORTER_OUTPUT: "${{github.run_id}}_sponge_log.xml"
       with:
diff --git a/.github/workflows/iam-deny.yaml b/.github/workflows/iam-deny.yaml
index 470581b7c3..2e2e097bfb 100644
--- a/.github/workflows/iam-deny.yaml
+++ b/.github/workflows/iam-deny.yaml
@@ -60,7 +60,7 @@ jobs:
          id: npm-cache-dir
          shell: bash
          run: echo "dir=$(npm config get cache)" >> ${GITHUB_OUTPUT}
-       - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4
+       - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
          id: npm-cache
          with:
           path: ${{ steps.npm-cache-dir.outputs.dir }}
@@ -81,7 +81,7 @@ jobs:
        - run: npm test
        - name: upload test results for FlakyBot workflow
          if: github.event.action == 'schedule' && always()
-         uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
+         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
          env:
           MOCHA_REPORTER_OUTPUT: "${{github.run_id}}_sponge_log.xml"
          with:
diff --git a/.github/workflows/storagetransfer.yaml b/.github/workflows/storagetransfer.yaml
index e7e4ce8d3c..0d73bdaae2 100644
--- a/.github/workflows/storagetransfer.yaml
+++ b/.github/workflows/storagetransfer.yaml
@@ -65,7 +65,7 @@ jobs:
       id: npm-cache-dir
       shell: bash
       run: echo "dir=$(npm config get cache)" >> ${GITHUB_OUTPUT}
-    - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4
+    - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
       id: npm-cache
       with:
         path: ${{ steps.npm-cache-dir.outputs.dir }}
@@ -92,7 +92,7 @@ jobs:
         AZURE_SAS_TOKEN: ${{ fromJSON(steps.secrets.outputs.sts_azure_secret).SAS }}
     - name: upload test results for FlakyBot workflow
       if: github.event.action == 'schedule' && always()
-      uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       env:
         MOCHA_REPORTER_OUTPUT: "${{github.run_id}}_sponge_log.xml"
       with:
diff --git a/.github/workflows/test.yaml b/.github/workflows/test.yaml
index a8ae8c6b7c..916708a517 100644
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -47,7 +47,7 @@ jobs:
       id: npm-cache-dir
       shell: bash
       run: echo "dir=$(npm config get cache)" >> ${GITHUB_OUTPUT}
-    - uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4
+    - uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
       id: npm-cache
       with:
         path: ${{ steps.npm-cache-dir.outputs.dir }}
@@ -67,7 +67,7 @@ jobs:
         GOOGLE_SAMPLES_PROJECT: "long-door-651"
     - name: upload test results for FlakyBot workflow
       if: github.event.action == 'schedule' && always()
-      uses: actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: test-results
         path: ${{ inputs.path }}/${{ env.MOCHA_REPORTER_OUTPUT }}