diff --git a/.github/workflows/pr-validation.yml b/.github/workflows/pr-validation.yml
index 0978538a9..885817f7f 100644
--- a/.github/workflows/pr-validation.yml
+++ b/.github/workflows/pr-validation.yml
@@ -15,6 +15,7 @@ on:
 permissions:
   contents: read
   pull-requests: write
+  issues: write
 
 jobs:
   validate-changed-rooms:
@@ -22,12 +23,12 @@ jobs:
     
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
 
       - name: Setup Bun
-        uses: oven-sh/setup-bun@v1
+        uses: oven-sh/setup-bun@3d267786b128fe76c2f16a390aa2448b815359f3 # v2.1.2
         with:
           bun-version: latest
 
@@ -79,7 +80,7 @@ jobs:
 
       - name: Comment validation results
         if: always() && steps.changed-files.outputs.count > 0
-        uses: actions/github-script@v7
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: |
             const fs = require('fs');
@@ -122,4 +123,4 @@ jobs:
       - name: Skip validation
         if: steps.changed-files.outputs.count == 0
         run: |
-          echo "ℹ️ No room files changed in this PR - skipping validation"
\ No newline at end of file
+          echo "ℹ️ No room files changed in this PR - skipping validation"
diff --git a/.github/workflows/release-please.yaml b/.github/workflows/release-please.yaml
index 1a92649a2..a5343912d 100644
--- a/.github/workflows/release-please.yaml
+++ b/.github/workflows/release-please.yaml
@@ -17,7 +17,7 @@ jobs:
       release_created: ${{ steps.release.outputs.release_created }}
       tag_name: ${{ steps.release.outputs.tag_name }}
     steps:
-      - uses: googleapis/release-please-action@v4
+      - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4.4.0
         id: release
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -29,11 +29,11 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ needs.release-please.outputs.tag_name }}
       
-      - uses: oven-sh/setup-bun@v1
+      - uses: oven-sh/setup-bun@3d267786b128fe76c2f16a390aa2448b815359f3 # v2.1.2
         with:
           bun-version: latest
       
@@ -54,4 +54,4 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           gh release upload ${{ needs.release-please.outputs.tag_name }} mapdb.json --clobber
-          gh release upload ${{ needs.release-please.outputs.tag_name }} stringprocs.tar.gz --clobber
\ No newline at end of file
+          gh release upload ${{ needs.release-please.outputs.tag_name }} stringprocs.tar.gz --clobber
diff --git a/.github/workflows/semantic-pr.yml b/.github/workflows/semantic-pr.yml
index 9221304cf..723787dd0 100644
--- a/.github/workflows/semantic-pr.yml
+++ b/.github/workflows/semantic-pr.yml
@@ -18,6 +18,6 @@ jobs:
     name: semantic-pr
     runs-on: ubuntu-latest
     steps:
-      - uses: amannn/action-semantic-pull-request@v5
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
\ No newline at end of file
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}