diff --git a/.github/workflows/deploy-dev.yml b/.github/workflows/deploy-dev.yml
index 1418b09b0..a822ad8a8 100644
--- a/.github/workflows/deploy-dev.yml
+++ b/.github/workflows/deploy-dev.yml
@@ -11,15 +11,19 @@ jobs:
 
     steps:
       - name: Connect to Tailscale
-        uses: tailscale/github-action@v2
+        # SHA-pinned to mitigate supply-chain hijack of the v2 floating tag.
+        uses: tailscale/github-action@05c58255396c88c609919d571a8b117099c69020 # v2
         with:
           authkey: ${{ secrets.TAILSCALE_AUTH_KEY }}
 
       - name: Deploy
-        uses: appleboy/ssh-action@v1
+        # SHA-pinned to mitigate supply-chain hijack of the v1 floating tag.
+        uses: appleboy/ssh-action@0ff4204d59e8e51228ff73bce53f80d53301dee2 # v1
         with:
-          host: 100.96.144.19
-          username: trinity
+          # Host + username come from repo secrets so this public workflow file
+          # doesn't disclose the Tailscale topology of the dev environment.
+          host: ${{ secrets.DEV_HOST }}
+          username: ${{ secrets.DEV_USER }}
           key: ${{ secrets.DEV_SSH_KEY }}
           command_timeout: 25m
           script: |
diff --git a/.github/workflows/publish-cli.yml b/.github/workflows/publish-cli.yml
index 52adfa178..ea5f0da63 100644
--- a/.github/workflows/publish-cli.yml
+++ b/.github/workflows/publish-cli.yml
@@ -84,7 +84,8 @@ jobs:
 
       - name: Publish to PyPI
         if: steps.check.outputs.skip != 'true'
-        uses: pypa/gh-action-pypi-publish@release/v1
+        # SHA-pinned to mitigate supply-chain hijack of the release/v1 branch.
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1
         with:
           packages-dir: src/cli/dist/
 
diff --git a/.github/workflows/sync-docs-to-vertex.yml b/.github/workflows/sync-docs-to-vertex.yml
index e41cd6ebd..8c409ef70 100644
--- a/.github/workflows/sync-docs-to-vertex.yml
+++ b/.github/workflows/sync-docs-to-vertex.yml
@@ -26,13 +26,15 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Authenticate to Google Cloud
-        uses: google-github-actions/auth@v2
+        # SHA-pinned to mitigate supply-chain hijack of the v2 floating tag.
+        uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed # v2
         with:
           workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER }}
           service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}
 
       - name: Set up Cloud SDK
-        uses: google-github-actions/setup-gcloud@v2
+        # SHA-pinned to mitigate supply-chain hijack of the v2 floating tag.
+        uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f # v2
 
       - name: Convert and sync docs to GCS
         run: |