diff --git a/.github/actions/build-docker-image/action.yml b/.github/actions/build-docker-image/action.yml
index f7aec10..e1ec57c 100644
--- a/.github/actions/build-docker-image/action.yml
+++ b/.github/actions/build-docker-image/action.yml
@@ -45,7 +45,7 @@ runs:
   using: "composite"
   steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
       with:
         ref: ${{ inputs.ref }}
         fetch-depth: 0
@@ -94,7 +94,7 @@ runs:
         ${{inputs.dry_run}} || docker save "${DOCKER_IMAGE_NAME}" -o "${TAR_FILE}"
 
     - name: Upload Docker image artifact
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
       with:
         name: ${{ steps.create-tar-file.outputs.artifact_name }}
         path: ${{ env.TAR_FILE }}
diff --git a/.github/actions/cmd-in-docker/action.yml b/.github/actions/cmd-in-docker/action.yml
index 15a0d18..4cb5d10 100644
--- a/.github/actions/cmd-in-docker/action.yml
+++ b/.github/actions/cmd-in-docker/action.yml
@@ -57,7 +57,7 @@ runs:
     - name: Restore cache
       id: cache_restore
       if: ${{ inputs.use_cache == 'yes' }}
-      uses: WarpBuilds/cache/restore@v1
+      uses: WarpBuilds/cache/restore@40f3443ae7b70e568d6e2070ea897f3df94d7553 # v1.4.13
       with:
         path: |
           ~/.cargo/bin/
@@ -92,7 +92,7 @@ runs:
     - name: Clear cache before saving new version
       id: clear_cache
       if: ${{ inputs.use_cache == 'yes' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) }}
-      uses: WarpBuilds/cache@v1
+      uses: WarpBuilds/cache@40f3443ae7b70e568d6e2070ea897f3df94d7553 # v1.4.13
       with:
         path: |
           ~/.cargo/bin/
@@ -107,7 +107,7 @@ runs:
     # Save cache key for default_branch triggered by merge into default_branch event ONLY
     - name: Save cache
       if: ${{ inputs.use_cache == 'yes' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && steps.clear_cache.outcome == 'success' }}
-      uses: WarpBuilds/cache/save@v1
+      uses: WarpBuilds/cache/save@40f3443ae7b70e568d6e2070ea897f3df94d7553 # v1.4.13
       with:
         path: |
           ~/.cargo/bin/
diff --git a/.github/workflows/CI-audit.yml b/.github/workflows/CI-audit.yml
index 96f8f98..82ddbd9 100644
--- a/.github/workflows/CI-audit.yml
+++ b/.github/workflows/CI-audit.yml
@@ -14,7 +14,7 @@ jobs:
     name: Cargo audit
     steps:
       - name: Git checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Cargo audit
         uses: ./.github/actions/cmd-in-docker
@@ -25,7 +25,7 @@ jobs:
 
       - name: Upload cargo audit output
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: audit-output
           path: audit_output.txt
@@ -41,8 +41,11 @@ jobs:
     if: ${{ failure() && !cancelled() && github.event_name == 'schedule' }}
     steps:
       - name: Send Slack notification
-        uses: slackapi/slack-github-action@v1.25.0
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
         with:
+          webhook: ${{ secrets.SLACK_WEBHOOK_ALERTS_ZKVERIFY }}
+          webhook-type: incoming-webhook
+          errors: true
           payload: |
             {
               "blocks": [
@@ -50,7 +53,7 @@ jobs:
                   "type": "header",
                   "text": {
                     "type": "plain_text",
-                    "text": "🚨 ALERT - ${{ github.workflow }} Job Failed! 🚨"
+                    "text": "🚨 VFlow ALERT - ${{ github.workflow }} Job Failed! 🚨"
                   }
                 },
                 {
@@ -64,6 +67,3 @@ jobs:
                 }
               ]
             }
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.QA_SLACK_WEBHOOK_URL }}
-          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
diff --git a/.github/workflows/CI-build-docker-image.yml b/.github/workflows/CI-build-docker-image.yml
index 0940be5..988f4b1 100644
--- a/.github/workflows/CI-build-docker-image.yml
+++ b/.github/workflows/CI-build-docker-image.yml
@@ -14,7 +14,7 @@ jobs:
     name: Build Docker image
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Docker build
         id: build-docker-image
diff --git a/.github/workflows/CI-build.yml b/.github/workflows/CI-build.yml
index fea4cf4..44dea13 100644
--- a/.github/workflows/CI-build.yml
+++ b/.github/workflows/CI-build.yml
@@ -12,7 +12,7 @@ jobs:
     name: Build vflow-node
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: vflow-node build
         uses: ./.github/actions/cmd-in-docker
@@ -22,7 +22,7 @@ jobs:
           cache_key: 'build-vflow-node'
 
       - name: Upload vflow-node build binaries
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: "vflow-node-bin"
           path: |
diff --git a/.github/workflows/CI-cache-cleanup.yaml b/.github/workflows/CI-cache-cleanup.yaml
index a3cd423..675e6b3 100644
--- a/.github/workflows/CI-cache-cleanup.yaml
+++ b/.github/workflows/CI-cache-cleanup.yaml
@@ -21,7 +21,7 @@ jobs:
           - unit-test
     steps:
       - name: "Deleting '${{ matrix.cache_key }}' cache key"
-        uses: WarpBuilds/cache@v1
+        uses: WarpBuilds/cache@40f3443ae7b70e568d6e2070ea897f3df94d7553 # v1.4.13
         with:
           path: |
             ~/.cargo/bin/
diff --git a/.github/workflows/CI-check-lockfile.yml b/.github/workflows/CI-check-lockfile.yml
index 8f923e5..9e3a623 100644
--- a/.github/workflows/CI-check-lockfile.yml
+++ b/.github/workflows/CI-check-lockfile.yml
@@ -12,7 +12,7 @@ jobs:
     name: Check lockfile
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Check lockfile
         uses: ./.github/actions/cmd-in-docker
diff --git a/.github/workflows/CI-feature-propagation.yml b/.github/workflows/CI-feature-propagation.yml
index 0d44e4c..fa9def4 100644
--- a/.github/workflows/CI-feature-propagation.yml
+++ b/.github/workflows/CI-feature-propagation.yml
@@ -12,7 +12,7 @@ jobs:
     name: Feature propagation
     steps:
       - name: Git checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Features
         uses: ./.github/actions/cmd-in-docker
@@ -23,7 +23,7 @@ jobs:
 
       - name: Upload feature propagation output
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: feature-propagation-output
           path: features_output.txt
diff --git a/.github/workflows/CI-lint-format.yml b/.github/workflows/CI-lint-format.yml
index 6adbf03..53584c4 100644
--- a/.github/workflows/CI-lint-format.yml
+++ b/.github/workflows/CI-lint-format.yml
@@ -12,7 +12,7 @@ jobs:
     name: Lint and format
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Cargo lint
         uses: ./.github/actions/cmd-in-docker
@@ -24,7 +24,7 @@ jobs:
 
       - name: Upload lint artifacts
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: lint-output
           path: linting_output.txt
@@ -41,7 +41,7 @@ jobs:
 
       - name: Upload format artifacts
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: format-output
           path: formatting_output.txt
@@ -58,7 +58,7 @@ jobs:
 
       - name: Upload format Cargo.toml artifacts
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: format-toml-output
           path: formatting_tomls.txt
diff --git a/.github/workflows/CI-machete.yml b/.github/workflows/CI-machete.yml
index e76767a..e588d97 100644
--- a/.github/workflows/CI-machete.yml
+++ b/.github/workflows/CI-machete.yml
@@ -12,7 +12,7 @@ jobs:
     name: Machete
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Run cargo machete
         uses: ./.github/actions/cmd-in-docker
diff --git a/.github/workflows/CI-release-runtime.yml b/.github/workflows/CI-release-runtime.yml
index 78e4860..20683d1 100644
--- a/.github/workflows/CI-release-runtime.yml
+++ b/.github/workflows/CI-release-runtime.yml
@@ -40,7 +40,7 @@ jobs:
       is-a-test-release: ${{ steps.check-requirements.outputs.TEST_RELEASE }}
     steps:
       - name: Git checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: ${{ github.ref }}
           fetch-depth: 0
@@ -65,7 +65,7 @@ jobs:
     needs: [ check-requirements ]
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Docker build
         id: build-docker-image
@@ -87,13 +87,13 @@ jobs:
     needs: [ build-docker ]
     steps:
       - name: Git checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: ${{ github.ref }}
           fetch-depth: 0
 
       - name: Download Docker runtime image artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: ${{ needs.build-docker.outputs.artifact_name }}
           path: ./
@@ -111,7 +111,7 @@ jobs:
           "${GITHUB_WORKSPACE}/ci/extract_wasm.sh" --image-artifact ${{ needs.build-docker.outputs.artifact_name }}
 
       - name: Upload runtime artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: runtimes
           path: ./*.compact.compressed.wasm
@@ -124,13 +124,13 @@ jobs:
     needs: [ check-requirements, build-docker, extract-runtimes ]
     steps:
       - name: Retrieve Docker runtime image artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: ${{ needs.build-docker.outputs.artifact_name }}
           path: docker-images/
 
       - name: Retrieve saved runtimes wasm
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: runtimes
           path: wasm
@@ -138,7 +138,7 @@ jobs:
       - name: Create Release
         id: create-release
         if: ${{ needs.check-requirements.outputs.is-a-release == 'true' }}
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
         with:
           tag_name: ${{ github.ref_name }}
           name: ${{ inputs.release_name }}
@@ -154,8 +154,14 @@ jobs:
 
       - name: Notify Slack Production Releases
         if: ${{ inputs.dry_run == false }}
-        uses: slackapi/slack-github-action@v1.25.0
+        # The release has already published at this point; a notification problem
+        # should be visible but must not red the job or skip what needs: it.
+        continue-on-error: true
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
         with:
+          webhook: ${{ secrets.RELEASES_PROD_SLACK_WEBHOOK_URL }}
+          webhook-type: incoming-webhook
+          errors: true
           payload: |
             {
               "blocks": [
@@ -181,6 +187,3 @@ jobs:
                 }
               ]
             }
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.RELEASES_PROD_SLACK_WEBHOOK_URL }}
-          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
diff --git a/.github/workflows/CI-release.yml b/.github/workflows/CI-release.yml
index 25160d5..b7b68df 100644
--- a/.github/workflows/CI-release.yml
+++ b/.github/workflows/CI-release.yml
@@ -41,7 +41,7 @@ jobs:
       version-str: ${{ steps.check-requirements.outputs.VERSION_STR }}
     steps:
       - name: Git checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: ${{ github.ref }}
           fetch-depth: 0
@@ -66,7 +66,7 @@ jobs:
     needs: [ check-requirements ]
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Docker build
         id: build-docker-image
@@ -86,13 +86,13 @@ jobs:
     needs: [ check-requirements, build-docker ]
     steps:
       - name: Git checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           ref: ${{ github.ref }}
           fetch-depth: 0
 
       - name: Download VFlow Docker image artifact
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: ${{ needs.build-docker.outputs.artifact_name }}
           path: ./
@@ -112,7 +112,7 @@ jobs:
           "${GITHUB_WORKSPACE}/ci/publish-docker-image.sh" --image-artifact ${{ needs.build-docker.outputs.artifact_name }}
 
       - name: Upload runtime artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: runtimes
           path: ./*.compact.compressed.wasm
@@ -125,7 +125,7 @@ jobs:
     needs: [ check-requirements, publish-docker-image ]
     steps:
       - name: Retrieve saved runtimes wasm
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: runtimes
           path: wasm
@@ -133,7 +133,7 @@ jobs:
       - name: Create Release
         id: create-release
         if: ${{ needs.check-requirements.outputs.is-a-release == 'true' }}
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
         with:
           tag_name: ${{ github.ref_name }}
           name: ${{ inputs.release_name }}
@@ -148,8 +148,14 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Notify Slack Production Releases
         if: ${{ inputs.dry_run == false }}
-        uses: slackapi/slack-github-action@v1.25.0
+        # The release has already published at this point; a notification problem
+        # should be visible but must not red the job or skip what needs: it.
+        continue-on-error: true
+        uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
         with:
+          webhook: ${{ secrets.RELEASES_PROD_SLACK_WEBHOOK_URL }}
+          webhook-type: incoming-webhook
+          errors: true
           payload: |
             {
               "blocks": [
@@ -182,6 +188,3 @@ jobs:
                 }
               ]
             }
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.RELEASES_PROD_SLACK_WEBHOOK_URL }}
-          SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
diff --git a/.github/workflows/CI-test-bench.yml b/.github/workflows/CI-test-bench.yml
index 38cc99a..c8d4a85 100644
--- a/.github/workflows/CI-test-bench.yml
+++ b/.github/workflows/CI-test-bench.yml
@@ -10,7 +10,7 @@ jobs:
     name: Build and run benchmarks
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: VFlow build with runtime-benchmarks
         uses: ./.github/actions/cmd-in-docker
diff --git a/.github/workflows/CI-test.yml b/.github/workflows/CI-test.yml
index 4383620..7c95323 100644
--- a/.github/workflows/CI-test.yml
+++ b/.github/workflows/CI-test.yml
@@ -12,7 +12,7 @@ jobs:
     name: Cargo unit test
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Cargo unit test
         uses: ./.github/actions/cmd-in-docker
@@ -40,7 +40,7 @@ jobs:
 
       - name: Upload unit test output
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: unit-test-output
           path: unit_test_output.txt
diff --git a/.github/workflows/CI-try-runtime.yml b/.github/workflows/CI-try-runtime.yml
index d8f3b32..230c6d3 100644
--- a/.github/workflows/CI-try-runtime.yml
+++ b/.github/workflows/CI-try-runtime.yml
@@ -43,7 +43,7 @@ jobs:
     name: Try runtime ${{ matrix.runtime }}
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Runtime ${{ matrix.runtime }} build
         uses: ./.github/actions/cmd-in-docker
diff --git a/.github/workflows/global.yml b/.github/workflows/global.yml
index cacfa99..cb02ca2 100644
--- a/.github/workflows/global.yml
+++ b/.github/workflows/global.yml
@@ -16,15 +16,13 @@ jobs:
   build:
     runs-on: warp-ubuntu-latest-x64-8x
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Rust Setup
-        uses: actions-rs/toolchain@v1
+        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
         with:
-          profile: minimal
           toolchain: stable
-          target: wasm32-unknown-unknown
-          override: true
+          targets: wasm32-unknown-unknown
           components: rustfmt, clippy, rust-src
 
       - name: APT update
@@ -37,7 +35,7 @@ jobs:
           protoc --version
 
       - name: Rust Cache
-        uses: Swatinem/rust-cache@v2.5.0
+        uses: Swatinem/rust-cache@2656b87321093db1cb55fbd73183d195214fdfd1 # v2.5.0
         with:
             cache-on-failure: true
             cache-all-crates: true