diff --git a/.github/workflows/admin-eslint.yml b/.github/workflows/admin-eslint.yml
index befdae7..b4ffa52 100644
--- a/.github/workflows/admin-eslint.yml
+++ b/.github/workflows/admin-eslint.yml
@@ -35,17 +35,17 @@ jobs:
         id: version
         if: ${{ inputs.shopwareVersion == '.auto' || inputs.shopwareVersion == '' }}
       - name: Clone Shopware
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           repository: ${{ inputs.shopware-repository || 'shopware/shopware' }}
           ref: ${{ steps.version.outputs.shopware-version || inputs.shopwareVersion }}
       - name: Clone Extension
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           path: custom/plugins/${{ inputs.extensionName }}
 
       - name: Setup Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: '20.x'
 
diff --git a/.github/workflows/admin-jest.yml b/.github/workflows/admin-jest.yml
index 0ff6832..3e02b4d 100644
--- a/.github/workflows/admin-jest.yml
+++ b/.github/workflows/admin-jest.yml
@@ -67,7 +67,7 @@ jobs:
 
       - name: Upload Coverage
         if: inputs.uploadCoverage == true
-        uses: codecov/codecov-action@v6
+        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
         env:
           CODECOV_TOKEN: ${{ secrets.codecovToken }}
         with:
diff --git a/.github/workflows/build-docker-image.yml b/.github/workflows/build-docker-image.yml
index 8d41a72..5398734 100644
--- a/.github/workflows/build-docker-image.yml
+++ b/.github/workflows/build-docker-image.yml
@@ -26,7 +26,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
         - name: Checkout Repository
-          uses: actions/checkout@v6
+          uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
         - name: Login into Github Docker Registery
           run: echo "${{ secrets.ghToken }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
@@ -35,13 +35,13 @@ jobs:
           uses: shopware/shopware-cli-action@v3
 
         - name: Install Bun
-          uses: oven-sh/setup-bun@v2
+          uses: oven-sh/setup-bun@0c5077e51419868618aeaa5fe8019c62421857d6 # v2.2.0
           if: inputs.use-bun == true
           with:
             bun-version: ${{ inputs.bun-version }}
         
         - name: Setup PHP
-          uses: shivammathur/setup-php@v2
+          uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # 2.37.1
           with:
             php-version: '${{ inputs.php-version }}'
             extensions: ${{ inputs.php-extensions }}
@@ -53,7 +53,7 @@ jobs:
 
         - name: Cache Composer
           id: composer
-          uses: actions/cache@v5
+          uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
           with:
             path: ${{ steps.composer-cache.outputs.dir }}
             key: ${{ runner.os }}-composer-${{ hashFiles('**/composer.lock') }}
@@ -78,7 +78,7 @@ jobs:
             GITHUB_REPOSITORY_NAME: ${{ github.event.repository.name }}
 
         - name: Build and push
-          uses: docker/build-push-action@v7
+          uses: docker/build-push-action@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0
           with:
             context: .
             file: ./docker/Dockerfile
diff --git a/.github/workflows/build-zip.yml b/.github/workflows/build-zip.yml
index fa78ed6..b6cd7dc 100644
--- a/.github/workflows/build-zip.yml
+++ b/.github/workflows/build-zip.yml
@@ -16,7 +16,7 @@ jobs:
     name: Build and Validate
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Install shopware-cli
         uses: shopware/shopware-cli-action@v3
       - name: Build
@@ -26,7 +26,7 @@ jobs:
       - name: Validate
         run: shopware-cli extension validate ${{ inputs.extensionName }}.zip
       - name: Upload artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ inputs.extensionName }}
           path: ${{ inputs.extensionName }}.zip
diff --git a/.github/workflows/cs-fixer.yml b/.github/workflows/cs-fixer.yml
index 7a3114c..db5be00 100644
--- a/.github/workflows/cs-fixer.yml
+++ b/.github/workflows/cs-fixer.yml
@@ -14,10 +14,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # 2.37.1
         with:
           php-version: 8.2
           tools: php-cs-fixer:3.63.2, cs2pr
diff --git a/.github/workflows/e2e.yml b/.github/workflows/e2e.yml
index d961576..233ba5a 100644
--- a/.github/workflows/e2e.yml
+++ b/.github/workflows/e2e.yml
@@ -73,7 +73,7 @@ jobs:
           install-admin: true
           allow-insecure-versions: true
       - name: Clone Extension
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           path: custom/plugins/${{ inputs.extensionName }}
       - name: Clone Dependencies
@@ -111,13 +111,13 @@ jobs:
           fi
       - name: Upload Playwright Artifacts
         if: ${{ inputs.e2eTestFramework == 'playwright' && failure() }}
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: playwright-screenshots
           path: custom/plugins/${{ inputs.extensionName }}/${{ inputs.e2ePath }}/test-results
       - name: Upload Cypress Artifacts
         if: ${{ inputs.e2eTestFramework == 'cypress' && failure() }}
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: cypress-screenshots
           path: custom/plugins/${{ inputs.extensionName }}/${{ inputs.e2ePath }}/cypress/screenshots
\ No newline at end of file
diff --git a/.github/workflows/phpstan.yml b/.github/workflows/phpstan.yml
index 3e3b98a..3a3b6a1 100644
--- a/.github/workflows/phpstan.yml
+++ b/.github/workflows/phpstan.yml
@@ -61,7 +61,7 @@ jobs:
           install: "true"
           allow-insecure-versions: true
       - name: Clone Extension
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           path: custom/plugins/${{ inputs.extensionName }}
       - name: Clone Dependencies
@@ -95,7 +95,7 @@ jobs:
         run: |
           printf "parameters:\n  tmpDir: ${{ env.SHOPWARE_TOOL_CACHE_PHPSTAN }}\nincludes:\n  - phpstan.neon.dist" > phpstan.neon
       - name: PHPStan cache
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ${{ env.SHOPWARE_TOOL_CACHE_PHPSTAN }}
           key: ${{ runner.OS }}-${{ github.repository }}-phpstan-${{ github.sha }}
diff --git a/.github/workflows/phpunit.yml b/.github/workflows/phpunit.yml
index 0dd3808..8e60d83 100644
--- a/.github/workflows/phpunit.yml
+++ b/.github/workflows/phpunit.yml
@@ -81,7 +81,7 @@ jobs:
           php-extensions: pcov
           allow-insecure-versions: true
       - name: Clone Extension
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           path: custom/plugins/${{ inputs.extensionName }}
       - name: Clone Dependencies
@@ -110,7 +110,7 @@ jobs:
           fi
       - name: Upload Coverage
         if: inputs.uploadCoverage == true
-        uses: codecov/codecov-action@v6
+        uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
         env:
           CODECOV_TOKEN: ${{ secrets.codecovToken }}
         with:
diff --git a/.github/workflows/store-release.yml b/.github/workflows/store-release.yml
index 5d00abd..7f585c1 100644
--- a/.github/workflows/store-release.yml
+++ b/.github/workflows/store-release.yml
@@ -39,7 +39,7 @@ jobs:
     environment: ${{ inputs.environment }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           # fetch all git entries for changelog generation
           fetch-depth: 0
@@ -54,7 +54,7 @@ jobs:
           shopware-cli extension zip --git-commit ${{ github.sha }} "${{ inputs.path }}" --release
           mv ${{ inputs.extensionName }}-${{ github.sha }}.zip ${{ inputs.extensionName }}.zip
       - name: Upload Artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: ${{ inputs.extensionName }}
           path: ${{ inputs.extensionName }}.zip
@@ -62,7 +62,7 @@ jobs:
         run: |
           echo "EXTENSION_VERSION=$(shopware-cli extension get-version .)" >> $GITHUB_ENV
       - name: Check Tag existence
-        uses: mukunku/tag-exists-action@v1.7.0
+        uses: mukunku/tag-exists-action@5c39604fe8aef7e65acb6fbcf96ec580f7680313 # v1.7.0
         id: checkTag
         with:
           tag: ${{ env.EXTENSION_VERSION }}
@@ -97,7 +97,7 @@ jobs:
           git push origin ${EXTENSION_VERSION}
       - name: Create a GitHub release
         if: steps.checkTag.outputs.exists != 'true' && inputs.publishOnly == false
-        uses: ncipollo/release-action@v1
+        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
         with:
           artifacts: /tmp/${{ inputs.extensionName }}.zip
           tag: ${{ env.EXTENSION_VERSION }}
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 81c37f2..834ee0b 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -7,7 +7,7 @@ jobs:
         runs-on: ubuntu-latest
         steps:
             - name: Checkout code
-              uses: actions/checkout@v6
+              uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
             - id: version
               uses: ./shopware-version
               with:
@@ -44,7 +44,7 @@ jobs:
                       expected-version: "6.7.2.x"
         steps:
             - name: Checkout code
-              uses: actions/checkout@v6
+              uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
             - name: Test shopware-version
               id: version
               uses: ./shopware-version
diff --git a/.github/workflows/theme.yml b/.github/workflows/theme.yml
index 1b4a0aa..3ca2d71 100644
--- a/.github/workflows/theme.yml
+++ b/.github/workflows/theme.yml
@@ -11,8 +11,8 @@ jobs:
     name: Build Theme
     runs-on: ${{ (github.event.act || !github.event.repository.private) && 'ubuntu-latest' || format('runs-on={0}/runner=sw-amd64', github.run_id) }}
     steps:
-      - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # v2.0.3
-      - uses: actions/checkout@v6
+      - uses: runs-on/action@d141ef83eb66d096ce8afc767e09115a65c63b60 # v2.1.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Build Theme
         uses: shopware/github-actions/build-zip@main
@@ -38,7 +38,7 @@ jobs:
         volumes:
           - /dev/shm/mysql:/var/lib/mysql
     steps:
-      - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # v2.0.3
+      - uses: runs-on/action@d141ef83eb66d096ce8afc767e09115a65c63b60 # v2.1.2
       - name: Setup and Install Theme
         uses: shopware/github-actions/setup-extension@main
         with:
@@ -58,8 +58,8 @@ jobs:
     outputs:
       test_jest: ${{ steps.should_run.outputs.test_jest }}
     steps:
-      - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # v2.0.3
-      - uses: actions/checkout@v6
+      - uses: runs-on/action@d141ef83eb66d096ce8afc767e09115a65c63b60 # v2.1.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Determine whether to run Jest tests
         id: should_run
@@ -75,8 +75,8 @@ jobs:
     env:
       STOREFRONT_PATH: "Resources/app/storefront"
     steps:
-      - uses: runs-on/action@cd2b598b0515d39d78c38a02d529db87d2196d1e # v2.0.3
-      - uses: actions/checkout@v6
+      - uses: runs-on/action@d141ef83eb66d096ce8afc767e09115a65c63b60 # v2.1.2
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Execute Jest tests
         working-directory: ${{ env.STOREFRONT_PATH }}
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..723ef36
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+.idea
\ No newline at end of file
diff --git a/admin-jest/action.yml b/admin-jest/action.yml
index 6af962b..5a13827 100644
--- a/admin-jest/action.yml
+++ b/admin-jest/action.yml
@@ -24,7 +24,7 @@ runs:
 
     - name: Upload Coverage
       if: inputs.uploadCoverage == true
-      uses: codecov/codecov-action@v6
+      uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
       with:
         root_dir: ${{ github.workspace }}/custom/plugins/${{ inputs.extensionName }}
         working-directory: ${{ github.workspace }}/custom/plugins/${{ inputs.extensionName }}
diff --git a/ai-release-notes/action.yml b/ai-release-notes/action.yml
index f9db9bc..e92aa8b 100644
--- a/ai-release-notes/action.yml
+++ b/ai-release-notes/action.yml
@@ -112,7 +112,7 @@ runs:
 
     - name: Generate raw release notes via GitHub API
       id: raw-notes
-      uses: actions/github-script@v9
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       env:
         INPUT_PREV_TAG: "${{ steps.prev-tag.outputs.prev_tag }}"
       with:
@@ -138,7 +138,7 @@ runs:
 
     - name: Rewrite release notes with AI
       id: ai-notes
-      uses: actions/github-script@v9
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       env:
         GITHUB_TOKEN: "${{ inputs.github-token }}"
         RAW_NOTES: "${{ steps.raw-notes.outputs.body }}"
@@ -251,7 +251,7 @@ runs:
     - name: Create GitHub release
       id: create-release
       if: inputs.create-release == 'true'
-      uses: actions/github-script@v9
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       env:
         AI_NOTES: "${{ steps.ai-notes.outputs.notes }}"
         INPUT_RELEASE_NAME: "${{ inputs.release-name }}"
diff --git a/build-zip/action.yml b/build-zip/action.yml
index 4ca686c..9ff2a07 100644
--- a/build-zip/action.yml
+++ b/build-zip/action.yml
@@ -34,7 +34,7 @@ runs:
   using: "composite"
   steps:
     - name: Clone
-      uses: actions/checkout@v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       if: inputs.skipCheckout == 'false'
       with:
           # fetch all git entries for changelog generation
@@ -51,7 +51,7 @@ runs:
       shell: bash
       run: shopware-cli extension validate ${{ inputs.extensionName }}.zip
     - name: Upload artifact
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       id: upload
       with:
         name: ${{ inputs.extensionName }}.zip
diff --git a/cs-fixer/action.yml b/cs-fixer/action.yml
index 0529d06..aac6077 100644
--- a/cs-fixer/action.yml
+++ b/cs-fixer/action.yml
@@ -15,10 +15,10 @@ runs:
   using: "composite"
   steps:
     - name: Checkout code
-      uses: actions/checkout@v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
     - name: Setup PHP
-      uses: shivammathur/setup-php@v2
+      uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # 2.37.1
       with:
         php-version: 8.2
         tools: php-cs-fixer:3.63.2, cs2pr
diff --git a/downstream/action.yml b/downstream/action.yml
index 26a26f0..6a9fb77 100644
--- a/downstream/action.yml
+++ b/downstream/action.yml
@@ -62,7 +62,7 @@ runs:
   using: "composite"
   steps:
     - name: Checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       with:
         persist-credentials: false
     - uses: shopware/octo-sts-action@main
diff --git a/eslint/action.yml b/eslint/action.yml
index dc65140..878986f 100644
--- a/eslint/action.yml
+++ b/eslint/action.yml
@@ -54,19 +54,19 @@ runs:
       id: version
       if: ${{ inputs.shopwareVersion == '.auto' || inputs.shopwareVersion == '' }}
     - name: Clone Shopware
-      uses: actions/checkout@v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       with:
         repository: ${{ inputs.shopware-repository || 'shopware/shopware' }}
         ref: ${{ steps.version.outputs.shopware-version || inputs.shopwareVersion }}
         token: ${{ inputs.shopware-github-token }}
 
     - name: Clone Extension
-      uses: actions/checkout@v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       with:
         path: custom/plugins/${{ inputs.extensionName }}
 
     - name: Setup Node
-      uses: actions/setup-node@v6
+      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
       with:
         node-version: "24.x"
 
diff --git a/phpstan/action.yml b/phpstan/action.yml
index b2fff01..0bcbc0a 100644
--- a/phpstan/action.yml
+++ b/phpstan/action.yml
@@ -25,7 +25,7 @@ runs:
       run: |
         printf "parameters:\n  tmpDir: ${{ inputs.cacheDir }}\nincludes:\n  - phpstan.neon.dist" > phpstan.neon
     - name: PHPStan cache
-      uses: actions/cache@v5
+      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         path: ${{ inputs.cacheDir }}
         key: ${{ runner.OS }}-${{ github.repository }}-phpstan-${{ github.sha }}
diff --git a/phpunit/action.yml b/phpunit/action.yml
index 3d06b44..0785df3 100644
--- a/phpunit/action.yml
+++ b/phpunit/action.yml
@@ -32,7 +32,7 @@ runs:
         fi
     - name: Upload Coverage
       if: inputs.uploadCoverage == true
-      uses: codecov/codecov-action@v6
+      uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
       with:
         root_dir: ${{ github.workspace }}/custom/plugins/${{ inputs.extensionName }}
         working-directory: ${{ github.workspace }}/custom/plugins/${{ inputs.extensionName }}
diff --git a/project-deployer/action.yml b/project-deployer/action.yml
index 8142a16..ff43a60 100644
--- a/project-deployer/action.yml
+++ b/project-deployer/action.yml
@@ -31,10 +31,10 @@ runs:
   steps:
     - name: Checkout
       if: inputs.skipCheckout != 'true'
-      uses: actions/checkout@v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
     - name: Setup PHP
-      uses: shivammathur/setup-php@v2
+      uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # 2.37.1
       with:
         php-version: ${{ inputs.phpVersion }}
 
@@ -47,7 +47,7 @@ runs:
         path: ${{ inputs.path }}
 
     - name: Deploy
-      uses: deployphp/action@v1
+      uses: deployphp/action@a1b46c204dbde25a32ed0d7bb6751ac3377ca1e9 # v1.0.26
       with:
         dep: ${{ inputs.deployCommand }}
         private-key: ${{ inputs.sshPrivateKey }}
diff --git a/project-validate/action.yml b/project-validate/action.yml
index dee7815..8d81620 100644
--- a/project-validate/action.yml
+++ b/project-validate/action.yml
@@ -24,10 +24,10 @@ runs:
   steps:
     - name: Checkout
       if: inputs.skipCheckout != 'true'
-      uses: actions/checkout@v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
     - name: Setup PHP
-      uses: shivammathur/setup-php@v2
+      uses: shivammathur/setup-php@7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc # 2.37.1
       with:
         php-version: ${{ inputs.phpVersion }}
 
@@ -35,7 +35,7 @@ runs:
       uses: shopware/shopware-cli-action@v3
 
     - name: Install dependencies
-      uses: ramsey/composer-install@v4
+      uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
 
     - name: Validate Project
       shell: bash
diff --git a/setup-extension/action.yml b/setup-extension/action.yml
index a40b3cf..d323096 100644
--- a/setup-extension/action.yml
+++ b/setup-extension/action.yml
@@ -144,7 +144,7 @@ runs:
 
     - name: Clone Extension
       if: ${{ ! inputs.extension-zip }}
-      uses: actions/checkout@v6
+      uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       with:
         persist-credentials: false
         ref: ${{ inputs.extensionRef || github.ref }}
@@ -153,7 +153,7 @@ runs:
 
     - name: Download extension zip
       if: ${{ inputs.extension-zip }}
-      uses: actions/download-artifact@v8
+      uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
       with:
         name: ${{ inputs.extension-zip }}
         path: custom/plugins/${{ inputs.extensionName }}
diff --git a/store-release/action.yml b/store-release/action.yml
index d3da3f2..6803bfb 100644
--- a/store-release/action.yml
+++ b/store-release/action.yml
@@ -64,7 +64,7 @@ runs:
       run: |
         echo "EXTENSION_VERSION=$(shopware-cli extension get-version .)" >> $GITHUB_ENV
     - name: Check Tag existence
-      uses: mukunku/tag-exists-action@v1.7.0
+      uses: mukunku/tag-exists-action@5c39604fe8aef7e65acb6fbcf96ec580f7680313 # v1.7.0
       id: checkTag
       with:
         tag: ${{ env.EXTENSION_VERSION }}
@@ -116,7 +116,7 @@ runs:
         git push origin ${EXTENSION_VERSION}
     - name: Create a GitHub release
       if: steps.checkTag.outputs.exists != 'true' && inputs.publishOnly == 'false'
-      uses: ncipollo/release-action@v1
+      uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # v1.21.0
       with:
         artifacts: /tmp/${{ inputs.extensionName }}.zip
         tag: ${{ env.EXTENSION_VERSION }}