diff --git a/.github/workflows/issue.yml b/.github/workflows/issue.yml
index 8056b72d..123c41f6 100644
--- a/.github/workflows/issue.yml
+++ b/.github/workflows/issue.yml
@@ -9,4 +9,4 @@ on:
 
 jobs:
   label-issue:
-    uses: cap-java/.github/.github/workflows/issue.yml@main
+    uses: cap-java/.github/.github/workflows/issue.yml@296573b55e906f5c77a1855bcfe4285cbbc5cac4 #main
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 0966aeb5..bb14e19b 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -20,7 +20,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Scan With Black Duck
-        uses: cap-java/.github/actions/scan-with-blackduck@main
+        uses: cap-java/.github/actions/scan-with-blackduck@296573b55e906f5c77a1855bcfe4285cbbc5cac4 #main
         with:
           blackduck_token: ${{ secrets.BLACK_DUCK_TOKEN }}
           maven-version: ${{ env.MAVEN_VERSION }}
@@ -29,7 +29,7 @@ jobs:
           scan_mode: FULL
 
   build-and-test:
-    uses: cap-java/cds-feature-attachments/.github/workflows/pipeline.yml@main
+    uses: cap-java/cds-feature-attachments/.github/workflows/pipeline.yml@296573b55e906f5c77a1855bcfe4285cbbc5cac4 #main
     permissions:
       contents: read
       security-events: write
diff --git a/.github/workflows/pipeline.yml b/.github/workflows/pipeline.yml
index ba384f14..b98fa8d9 100644
--- a/.github/workflows/pipeline.yml
+++ b/.github/workflows/pipeline.yml
@@ -82,7 +82,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Bind CF Services
-        uses: cap-java/cds-feature-attachments/.github/actions/cf-bind@main
+        uses: cap-java/cds-feature-attachments/.github/actions/cf-bind@296573b55e906f5c77a1855bcfe4285cbbc5cac4 #main
         with:
           cf-api: ${{ secrets[format('CF_API_{0}', matrix.hyperscaler)] }}
           cf-username: ${{ secrets.CF_USERNAME }}
@@ -92,7 +92,7 @@ jobs:
           auth-method: ${{ matrix.auth-method }}
 
       - name: Integration Tests
-        uses: cap-java/cds-feature-attachments/.github/actions/integration-tests@main
+        uses: cap-java/cds-feature-attachments/.github/actions/integration-tests@296573b55e906f5c77a1855bcfe4285cbbc5cac4 #main
         with:
           java-version: ${{ matrix.java-version }}
           maven-version: ${{ env.MAVEN_VERSION }}
@@ -110,7 +110,7 @@ jobs:
           fetch-depth: 0
 
       - name: Bind CF Services
-        uses: cap-java/cds-feature-attachments/.github/actions/cf-bind@main
+        uses: cap-java/cds-feature-attachments/.github/actions/cf-bind@296573b55e906f5c77a1855bcfe4285cbbc5cac4 #main
         with:
           cf-api: ${{ secrets.CF_API_AWS }}
           cf-username: ${{ secrets.CF_USERNAME }}
@@ -120,7 +120,7 @@ jobs:
           auth-method: basic
 
       - name: SonarQube Scan
-        uses: cap-java/.github/actions/scan-with-sonar@main
+        uses: cap-java/.github/actions/scan-with-sonar@296573b55e906f5c77a1855bcfe4285cbbc5cac4 #main
         with:
           java-version: 17
           maven-version: ${{ env.MAVEN_VERSION }}
@@ -149,7 +149,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: CodeQL Analysis
-        uses: cap-java/.github/actions/scan-with-codeql@main
+        uses: cap-java/.github/actions/scan-with-codeql@296573b55e906f5c77a1855bcfe4285cbbc5cac4 #main
         with:
           java-version: 17
           maven-version: ${{ env.MAVEN_VERSION }}
diff --git a/.github/workflows/pr.yml b/.github/workflows/pr.yml
index eba36d2d..6954b44d 100644
--- a/.github/workflows/pr.yml
+++ b/.github/workflows/pr.yml
@@ -24,7 +24,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Scan With Black Duck
-        uses: cap-java/.github/actions/scan-with-blackduck@main
+        uses: cap-java/.github/actions/scan-with-blackduck@296573b55e906f5c77a1855bcfe4285cbbc5cac4 #main
         with:
           blackduck_token: ${{ secrets.BLACK_DUCK_TOKEN }}
           maven-version: ${{ env.MAVEN_VERSION }}
@@ -34,5 +34,5 @@ jobs:
           rapid_compare_mode: BOM_COMPARE # PRs might only be blocked by things they introduce, not by pre-existing issues that could have appeared in the main branch in the meantime
 
   build-and-test:
-    uses: cap-java/cds-feature-attachments/.github/workflows/pipeline.yml@main
+    uses: cap-java/cds-feature-attachments/.github/workflows/pipeline.yml@296573b55e906f5c77a1855bcfe4285cbbc5cac4 #main
     secrets: inherit
diff --git a/.github/workflows/prevent-issue-labeling.yml b/.github/workflows/prevent-issue-labeling.yml
index d1319594..b30cc2cb 100644
--- a/.github/workflows/prevent-issue-labeling.yml
+++ b/.github/workflows/prevent-issue-labeling.yml
@@ -8,4 +8,4 @@ on:
 
 jobs:
   prevent-issue-labeling:
-    uses: cap-java/.github/.github/workflows/prevent-issue-labeling.yml@main
+    uses: cap-java/.github/.github/workflows/prevent-issue-labeling.yml@296573b55e906f5c77a1855bcfe4285cbbc5cac4 #main
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 52cddd97..cce3d403 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -70,7 +70,7 @@ jobs:
           ref: ${{ github.event.release.tag_name }}
 
       - name: Scan With Black Duck
-        uses: cap-java/.github/actions/scan-with-blackduck@main
+        uses: cap-java/.github/actions/scan-with-blackduck@296573b55e906f5c77a1855bcfe4285cbbc5cac4 #main
         with:
           blackduck_token: ${{ secrets.BLACK_DUCK_TOKEN }}
           github_token: ${{ secrets.GITHUB_TOKEN }}
@@ -93,7 +93,7 @@ jobs:
           ref: ${{ github.event.release.tag_name }}
 
       - name: Build
-        uses: cap-java/.github/actions/build@main
+        uses: cap-java/.github/actions/build@296573b55e906f5c77a1855bcfe4285cbbc5cac4 #main
         with:
           java-version: ${{ env.JAVA_VERSION }}
           maven-version: ${{ env.MAVEN_VERSION }}
@@ -113,7 +113,7 @@ jobs:
           ref: ${{ github.event.release.tag_name }}
 
       - name: Deploy
-        uses: cap-java/.github/actions/deploy-release@main
+        uses: cap-java/.github/actions/deploy-release@296573b55e906f5c77a1855bcfe4285cbbc5cac4 #main
         with:
           user: ${{ secrets.CENTRAL_REPOSITORY_USER }}
           password: ${{ secrets.CENTRAL_REPOSITORY_PASS }}
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 75049d23..6b8957eb 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -8,4 +8,4 @@ on:
 
 jobs:
   stale:
-    uses: cap-java/.github/.github/workflows/stale.yml@main
+    uses: cap-java/.github/.github/workflows/stale.yml@296573b55e906f5c77a1855bcfe4285cbbc5cac4 #main