diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 2bb8e1d69217..e26edb732433 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -11,7 +11,7 @@ jobs:
     steps:
       - run: sudo apt-get update && sudo apt-get install -y libhdf5-dev
       - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
         with:
           enable-cache: true
           cache-dependency-glob: uv.lock
diff --git a/.github/workflows/devcontainer_ci.yml b/.github/workflows/devcontainer_ci.yml
index d1b81593866f..eb76981f4d89 100644
--- a/.github/workflows/devcontainer_ci.yml
+++ b/.github/workflows/devcontainer_ci.yml
@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - uses: devcontainers/ci@v0.3
+      - uses: devcontainers/ci@8bf61b26e9c3a98f69cb6ce2f88d24ff59b785c6 # v0.3
         with:
           push: never
           runCmd: "true"
diff --git a/.github/workflows/directory_writer.yml b/.github/workflows/directory_writer.yml
index deffbe9e364f..51239c9c30c4 100644
--- a/.github/workflows/directory_writer.yml
+++ b/.github/workflows/directory_writer.yml
@@ -18,7 +18,9 @@ jobs:
           scripts/build_directory_md.py 2>&1 | tee DIRECTORY.md
           git config --global user.name "$GITHUB_ACTOR"
           git config --global user.email "$GITHUB_ACTOR@users.noreply.github.com"
-          git remote set-url origin https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/$GITHUB_REPOSITORY
+          git remote set-url origin https://x-access-token:${GITHUB_TOKEN}@github.com/$GITHUB_REPOSITORY
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Update DIRECTORY.md
         run: |
           git add DIRECTORY.md
diff --git a/.github/workflows/project_euler.yml b/.github/workflows/project_euler.yml
index 591b2163cc1a..2d4464ae897c 100644
--- a/.github/workflows/project_euler.yml
+++ b/.github/workflows/project_euler.yml
@@ -22,7 +22,7 @@ jobs:
           libhdf5-dev
           libopenblas-dev
       - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
       - uses: actions/setup-python@v6
         with:
           python-version: 3.14
@@ -40,7 +40,7 @@ jobs:
           libhdf5-dev
           libopenblas-dev
       - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
       - uses: actions/setup-python@v6
         with:
           python-version: 3.14
diff --git a/.github/workflows/ruff.yml b/.github/workflows/ruff.yml
index 13df19c8d743..71e02b451256 100644
--- a/.github/workflows/ruff.yml
+++ b/.github/workflows/ruff.yml
@@ -12,5 +12,5 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
       - run: uvx ruff check --output-format=github .
diff --git a/.github/workflows/sphinx.yml b/.github/workflows/sphinx.yml
index c5707804b1fa..d7cbaecd4f08 100644
--- a/.github/workflows/sphinx.yml
+++ b/.github/workflows/sphinx.yml
@@ -33,7 +33,7 @@ jobs:
           libhdf5-dev
           libopenblas-dev
       - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78 # v7
       - uses: actions/setup-python@v6
         with:
           python-version: 3.14