diff --git a/.github/actions/build-vsix/action.yml b/.github/actions/build-vsix/action.yml
index c6a943f3e85b..6042874eda1d 100644
--- a/.github/actions/build-vsix/action.yml
+++ b/.github/actions/build-vsix/action.yml
@@ -22,17 +22,19 @@ runs:
   using: 'composite'
   steps:
     - name: Install Node
-      uses: actions/setup-node@v7
+      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
       with:
         node-version: ${{ inputs.node_version }}
         cache: 'npm'
 
     - name: Rust Tool Chain setup
-      uses: dtolnay/rust-toolchain@stable
+      uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # stable
+      with:
+        toolchain: stable
 
     # Jedi LS depends on dataclasses which is not in the stdlib in Python 3.7.
     - name: Use Python 3.10 for JediLSP
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: '3.10'
         cache: 'pip'
diff --git a/.github/actions/lint/action.yml b/.github/actions/lint/action.yml
index 26bfc8ec1c18..dbca75537bad 100644
--- a/.github/actions/lint/action.yml
+++ b/.github/actions/lint/action.yml
@@ -10,7 +10,7 @@ runs:
   using: 'composite'
   steps:
     - name: Install Node
-      uses: actions/setup-node@v7
+      uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
       with:
         node-version: ${{ inputs.node_version }}
         cache: 'npm'
@@ -36,7 +36,7 @@ runs:
       shell: bash
 
     - name: Install Python
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
       with:
         python-version: '3.x'
         cache: 'pip'
diff --git a/.github/actions/smoke-tests/action.yml b/.github/actions/smoke-tests/action.yml
index 0531ef5d42a3..edd61804ba5b 100644
--- a/.github/actions/smoke-tests/action.yml
+++ b/.github/actions/smoke-tests/action.yml
@@ -13,13 +13,13 @@ runs:
   using: 'composite'
   steps:
     - name: Install Node
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
       with:
         node-version: ${{ inputs.node_version }}
         cache: 'npm'
 
     - name: Install Python
-      uses: actions/setup-python@v5
+      uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       with:
         python-version: '3.x'
         cache: 'pip'
@@ -43,7 +43,7 @@ runs:
 
     # Bits from the VSIX are reused by smokeTest.ts to speed things up.
     - name: Download VSIX
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
       with:
         name: ${{ inputs.artifact_name }}
 
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 14c8e18d475d..0c90f35a4b52 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -6,6 +6,8 @@ updates:
       interval: daily
     labels:
       - 'no-changelog'
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: 'github-actions'
     directory: .github/actions/build-vsix
@@ -13,6 +15,8 @@ updates:
       interval: daily
     labels:
       - 'no-changelog'
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: 'github-actions'
     directory: .github/actions/lint
@@ -20,6 +24,8 @@ updates:
       interval: daily
     labels:
       - 'no-changelog'
+    cooldown:
+      default-days: 7
 
   - package-ecosystem: 'github-actions'
     directory: .github/actions/smoke-test
@@ -27,6 +33,8 @@ updates:
       interval: daily
     labels:
       - 'no-changelog'
+    cooldown:
+      default-days: 7
 
   # Not skipping the news for some Python dependencies in case it's actually useful to communicate to users.
   - package-ecosystem: 'pip'
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index fec84fe226d5..59890d51d535 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -239,7 +239,7 @@ jobs:
           sparse-checkout-cone-mode: false
 
       - name: Install Node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: 'npm'
@@ -273,7 +273,9 @@ jobs:
         run: python -m pip install --upgrade -r build/test-requirements.txt
 
       - name: Rust Tool Chain setup
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # stable
+        with:
+          toolchain: stable
 
       - name: Build Native Binaries
         run: nox --session native_build
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index d322673a0d62..04a0a3ebbaf1 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -42,7 +42,7 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.37.9
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -67,4 +67,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4.37.9
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
diff --git a/.github/workflows/pr-check.yml b/.github/workflows/pr-check.yml
index 32f1ffa94685..d36b4262f658 100644
--- a/.github/workflows/pr-check.yml
+++ b/.github/workflows/pr-check.yml
@@ -232,7 +232,7 @@ jobs:
           sparse-checkout-cone-mode: false
 
       - name: Install Node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: 'npm'
@@ -266,7 +266,9 @@ jobs:
         run: python -m pip install --upgrade -r build/test-requirements.txt
 
       - name: Rust Tool Chain setup
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # stable
+        with:
+          toolchain: stable
 
       - name: Build Native Binaries
         run: nox --session native_build
@@ -507,7 +509,7 @@ jobs:
           sparse-checkout-cone-mode: false
 
       - name: Install Node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: 'npm'
@@ -548,7 +550,9 @@ jobs:
         shell: bash
 
       - name: Rust Tool Chain setup
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@7e38f4b43b4db5c8dd498af069a4f6196df1d067 # stable
+        with:
+          toolchain: stable
 
       - name: Build Native Binaries
         run: nox --session native_build