diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000..2c48305b7
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,11 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    groups:
+      github-actions:
+        patterns: ["*"]
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/AKSC_Deploy.yml b/.github/workflows/AKSC_Deploy.yml
index 6f575b374..d2e7d2238 100644
--- a/.github/workflows/AKSC_Deploy.yml
+++ b/.github/workflows/AKSC_Deploy.yml
@@ -74,7 +74,7 @@ jobs:
       AGNAME: ${{ steps.deployAks.outputs.AGNAME }}
     steps:
       # Login to Azure
-    - uses: azure/login@v2
+    - uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1
       name: Initial Login to Azure to Deploy
       with:
         client-id: ${{ secrets.AZURE_CLIENT_ID }}
@@ -139,7 +139,7 @@ jobs:
         echo "AGNAME=$appGatewayName" >> $GITHUB_OUTPUT
 
       # Re-Login to Azure if we're using the AKS RUN COMMAND
-    - uses: azure/login@v2
+    - uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1
       name: Initial Login to Azure to Deploy
       if: inputs.postScriptParams && inputs.postScriptInvokeCommand == true
       with:
diff --git a/.github/workflows/AksTroubleshooting.yml b/.github/workflows/AksTroubleshooting.yml
index 10e844627..64c4dad2f 100644
--- a/.github/workflows/AksTroubleshooting.yml
+++ b/.github/workflows/AksTroubleshooting.yml
@@ -85,7 +85,7 @@ jobs:
         run: az extension add -n log-analytics -y
 
       - name: Azure Login
-        uses: azure/login@v2
+        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1
         with:
           creds:  ${{ secrets.AZURE_CREDENTIALS }}
           enable-AzPSSession: true
@@ -138,7 +138,7 @@ jobs:
     if: always() && inputs.AGNAME != ''
     steps:
       - name: Azure Login
-        uses: azure/login@v2
+        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1
         with:
           creds: ${{ secrets.AZURE_CREDENTIALS }}
           enable-AzPSSession: true
@@ -233,7 +233,7 @@ jobs:
 
       - name: Store any generated debug json files as artifacts
         if: always()
-        uses: actions/upload-artifact@v4.3.1
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
         with:
           name: Troubleshooting-AGIC
           path: debug*.*
@@ -252,7 +252,7 @@ jobs:
           echo "LA workspace guid is ${{ inputs.LAWGUID }}"
 
       - name: Azure Login
-        uses: azure/login@v2
+        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1
         with:
           creds: ${{ secrets.AZURE_CREDENTIALS }}
           enable-AzPSSession: true
@@ -275,7 +275,7 @@ jobs:
 
       - name: Check Run Command
         if: inputs.USERUNCMD == true
-        uses: Azure/cli@v2
+        uses: Azure/cli@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0
         env:
           AZCLIVERSION: latest
         with:
diff --git a/.github/workflows/AppDeploy_AzureVote.yml b/.github/workflows/AppDeploy_AzureVote.yml
index 71e255a1d..0d621104a 100644
--- a/.github/workflows/AppDeploy_AzureVote.yml
+++ b/.github/workflows/AppDeploy_AzureVote.yml
@@ -70,7 +70,7 @@ jobs:
       AKSNAME: "${{ inputs.AKSNAME}}"
       RG: "${{ inputs.RG }}"
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Job parameter inspection
         run: |
@@ -79,7 +79,7 @@ jobs:
           echo "AKS name is ${{ inputs.AKSNAME }}"
 
       - name: Azure Login
-        uses: azure/login@v2
+        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1
         with:
           creds: ${{ secrets.AZURE_CREDENTIALS }}
           enable-AzPSSession: false
@@ -271,7 +271,7 @@ jobs:
 
       - name: Store any generated debug files as artifacts
         if: always()
-        uses: actions/upload-artifact@v4.3.1
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
         with:
           name: DebugFiles
           path: debug*.json
diff --git a/.github/workflows/AppDeploy_JavaApp.yml b/.github/workflows/AppDeploy_JavaApp.yml
index 1add77044..e5f4cdad5 100644
--- a/.github/workflows/AppDeploy_JavaApp.yml
+++ b/.github/workflows/AppDeploy_JavaApp.yml
@@ -62,7 +62,7 @@ jobs:
     runs-on: ubuntu-latest
     concurrency: "Ag-${{ inputs.AGNAME}}" #AppGateway doesn't like concurrent updates
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Job parameter inspection
         run: |
@@ -72,7 +72,7 @@ jobs:
           echo "CertManager version is ${{ inputs.CERTMANAGERVERSION }}"
 
       - name: Azure Login
-        uses: azure/login@v2
+        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1
         with:
           creds: ${{ secrets.AZURE_CREDENTIALS }}
           enable-AzPSSession: false
diff --git a/.github/workflows/ByoVnetCI.yml b/.github/workflows/ByoVnetCI.yml
index 88c2bbce4..47db0c1c1 100644
--- a/.github/workflows/ByoVnetCI.yml
+++ b/.github/workflows/ByoVnetCI.yml
@@ -95,13 +95,13 @@ jobs:
     needs: [Validation]
     if:  github.event_name != 'pull_request' || github.event.inputs.doWellArchitected == 'true' ||  contains( github.event.pull_request.labels.*.name, 'test-deploy-byoconfig')
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       # PSRule does this cool thing where it traverse the parameter file through to the arm template
       # PSRule performs IaC recommendations of the template.
       # https://azure.github.io/PSRule.Rules.Azure/
       - name: PSRule for Azure - Well Architected
-        uses: microsoft/ps-rule@v2.7.0
+        uses: microsoft/ps-rule@1570d7788f7aaa44c3375a6f52ee9404c694fc91 # v2.7.0
         #uses: microsoft/ps-rule@main
         continue-on-error: true #Setting this whilst PSRule gets bedded in, in this project
         with:
@@ -112,7 +112,7 @@ jobs:
       # In addition to the Well Architected analysis, we can also leverage the CAF rules
       # Run analysis against PSRule for Cloud Adoption Framework
       - name: PSRule for CAF
-        uses: microsoft/ps-rule@v2.7.0
+        uses: microsoft/ps-rule@1570d7788f7aaa44c3375a6f52ee9404c694fc91 # v2.7.0
         continue-on-error: true #Setting this whilst PSRule gets bedded in, in this project
         with:
           modules: 'PSRule.Rules.CAF'
@@ -148,7 +148,7 @@ jobs:
       PARAMOVERRIDES: ${{ steps.imperitiveparams.outputs.PARAMOVERRIDES}} #This won't work if the string includes any SECRETS!!!
       PARAMOVERRIDESNOSECRETS: ${{ steps.imperitiveparams.outputs.PARAMOVERRIDESNOSECRETS}}
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Job parameter check
         run: |
@@ -212,7 +212,7 @@ jobs:
             echo "NEWRESNAME=$NEWRESNAME" >> $GITHUB_OUTPUT
 
       - name: Azure Login
-        uses: azure/login@v2
+        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -232,7 +232,7 @@ jobs:
         if: github.event.inputs.doVerifySteps == 'true'
         env:
           RG: ${{ steps.params.outputs.RESOURCEGROUP }}
-        uses: Azure/cli@v2
+        uses: Azure/cli@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0
         with:
           azcliversion: ${{ env.AZCLIVERSION }}
           inlineScript: |
@@ -288,7 +288,7 @@ jobs:
           }
 
       - name: Create Parameter file imperative override string
-        uses: Azure/cli@v2
+        uses: Azure/cli@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0
         id: imperitiveparams
         env:
           RG: ${{ steps.params.outputs.RESOURCEGROUP }}
@@ -304,7 +304,7 @@ jobs:
             echo "PARAMOVERRIDESNOSECRETS=$PARAMOVERRIDESNOSECRETS" >> $GITHUB_OUTPUT
 
       - name: Validate Infrastructure deployment
-        uses: Azure/cli@v2
+        uses: Azure/cli@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0
         env:
           RG: ${{ steps.params.outputs.RESOURCEGROUP }}
         with:
@@ -319,7 +319,7 @@ jobs:
             az deployment group validate -f bicep/main.bicep -g $RG -p ${{ env.ParamFilePath }} -p $PARAMS --verbose
 
       - name: What If (GA edge Az cli version) (has issues)
-        uses: Azure/cli@v2
+        uses: Azure/cli@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0
         id: edgeWhatIf
         env:
           RG: ${{ steps.params.outputs.RESOURCEGROUP }}
@@ -346,7 +346,7 @@ jobs:
             echo "edgeSuccess=true" >> $GITHUB_OUTPUT
 
       - name: What If (No Secrets param string, used for Cost Estimate)
-        uses: Azure/cli@v2
+        uses: Azure/cli@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0
         env:
           RG: ${{ steps.params.outputs.RESOURCEGROUP }}
         continue-on-error: true
@@ -367,7 +367,7 @@ jobs:
             cat $WHATIFPATH
 
       - name: What If (workaround task)
-        uses: Azure/cli@v2
+        uses: Azure/cli@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0
         continue-on-error: true #Setting to true due to bug in the AzureCLI https://github.com/Azure/azure-cli/issues/19850
         if: steps.edgeWhatIf.outputs.edgeSuccess != 'true'
         env:
@@ -481,7 +481,7 @@ jobs:
 
     if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || github.ref == 'refs/heads/develop' || contains( github.event.pull_request.labels.*.name, 'test-deploy-byoconfig')
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Job parameter check
         if: github.event.inputs.doDebugSteps == 'true'
@@ -505,7 +505,7 @@ jobs:
           }
 
       - name: Azure Login
-        uses: azure/login@v2
+        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
@@ -516,7 +516,7 @@ jobs:
 
       - name: Deploy Infrastructure
         id: deployAks
-        uses: Azure/cli@v2
+        uses: Azure/cli@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0
         with:
           azcliversion: ${{ env.AZCLIVERSION }}
           inlineScript: |
@@ -550,7 +550,7 @@ jobs:
 
 
       - name: Enable AGIC Addon
-        uses: Azure/cli@v2
+        uses: Azure/cli@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0
         if: ${{ needs.Deploy.outputs.AGNAME}} != ''
         with:
           azcliversion: ${{ env.AZCLIVERSION }}
@@ -676,7 +676,7 @@ jobs:
   SmokeTest_JavaApp-certmgr:
     needs: [Deploy, ReusableWF, Post-Deploy]
     #uses: azure-samples/java-aks-keyvault-tls/.github/workflows/deployapp.yml@gb-workflow-bumps
-    uses: azure-samples/java-aks-keyvault-tls/.github/workflows/deployapp.yml@0.9.5
+    uses: azure-samples/java-aks-keyvault-tls/.github/workflows/deployapp.yml@57dd8b4cbfffcb24246250c6da79e5d6ff0dbbf1 # 0.9.5
     with:
       #ENVIRONMENT: ${{ needs.ReusableWF.outputs.ENVIRONMENT }}
       REPOREF: "0.9.5"
@@ -700,7 +700,7 @@ jobs:
 
   SmokeTest_JavaApp-appgw:
     needs: [Deploy, ReusableWF, Post-Deploy, SmokeTest_JavaApp-certmgr]
-    uses: azure-samples/java-aks-keyvault-tls/.github/workflows/deployapp.yml@0.9.5
+    uses: azure-samples/java-aks-keyvault-tls/.github/workflows/deployapp.yml@57dd8b4cbfffcb24246250c6da79e5d6ff0dbbf1 # 0.9.5
     with:
       #ENVIRONMENT: ${{ needs.ReusableWF.outputs.ENVIRONMENT }}
       REPOREF: "0.9.5"
@@ -728,7 +728,7 @@ jobs:
     env:
       RG: ${{ needs.Validation.outputs.RESOURCEGROUP }}
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Param check
         if: github.event.inputs.doDebugSteps == 'true'
@@ -740,7 +740,7 @@ jobs:
           echo "AKS name is ${{ needs.Deploy.outputs.AKSNAME }}"
 
       - name: Azure Login
-        uses: azure/login@v2
+        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
diff --git a/.github/workflows/ByoVnetPrivateCI.yml b/.github/workflows/ByoVnetPrivateCI.yml
index 08366cd73..ee1e1a7fe 100644
--- a/.github/workflows/ByoVnetPrivateCI.yml
+++ b/.github/workflows/ByoVnetPrivateCI.yml
@@ -91,13 +91,13 @@ jobs:
     environment: ${{ github.event.inputs.environment }}
     if:  github.event_name == 'pull_request' || github.event.inputs.doWellArchitected == 'true'
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       # PSRule does this cool thing where it traverse the parameter file through to the arm template
       # PSRule performs IaC recommendations of the template.
       # https://azure.github.io/PSRule.Rules.Azure/
       - name: PSRule - Analyze Azure parameter file
-        uses: Microsoft/ps-rule@v2.3.2
+        uses: Microsoft/ps-rule@67f1f9054911c456a7dbb950201f666f0b744bc7 # v2.3.2
         continue-on-error: true #Setting this whilst PSRule gets bedded in, in this project
         with:
           modules: 'PSRule.Rules.Azure'
@@ -160,7 +160,7 @@ jobs:
       RESNAME: ${{ steps.params.outputs.NEWRESNAME}}
 
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Job parameter check
         run: |
@@ -216,7 +216,7 @@ jobs:
             echo "NEWRESNAME=$NEWRESNAME" >> $GITHUB_OUTPUT
 
       - name: Azure Login
-        uses: azure/login@v2
+        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1
         with:
           creds:  ${{ secrets.AZURE_CREDENTIALS }}
           enable-AzPSSession: false
@@ -226,7 +226,7 @@ jobs:
       - name: Verify any active Azure Resource Group Deployments #These can mess up our deployment
         if: github.event.inputs.doDebugSteps == 'true'
         id: activedeps
-        uses: Azure/cli@v2
+        uses: Azure/cli@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0
         with:
           azcliversion: ${{ env.AZCLIVERSION }}
           inlineScript: |
@@ -247,7 +247,7 @@ jobs:
             fi
 
       - name: Validate Infrastructure deployment
-        uses: Azure/cli@v2
+        uses: Azure/cli@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0
         with:
           azcliversion: ${{ env.AZCLIVERSION }}
           inlineScript: |
@@ -255,7 +255,7 @@ jobs:
 
       - name: What If
         if: github.event.inputs.doDebugSteps == 'true'
-        uses: Azure/cli@v2
+        uses: Azure/cli@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0
         continue-on-error: ${{ secrets.ISAZCLIWHATIFUNRELIABLE == 'true' }}
         with:
           azcliversion: ${{ env.AZCLIVERSION }}
@@ -277,7 +277,7 @@ jobs:
       REGION: ${{ needs.Validation.outputs.REGION }}
       RESNAME: ${{ needs.Validation.outputs.RESNAME }}
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Job parameter check
         if: github.event.inputs.doVerifySteps == 'true'
@@ -304,7 +304,7 @@ jobs:
           }
 
       - name: Azure Login
-        uses: azure/login@v2
+        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1
         with:
           creds:  ${{ secrets.AZURE_CREDENTIALS }}
           enable-AzPSSession: true
@@ -313,7 +313,7 @@ jobs:
 
       - name: Deploy Infrastructure
         id:  deployAks
-        uses: Azure/cli@v2
+        uses: Azure/cli@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0
         with:
           azcliversion: ${{ env.AZCLIVERSION }}
           inlineScript: |
@@ -348,7 +348,7 @@ jobs:
           sleep $DELAY
 
       - name: Enable AGIC Addon
-        uses: Azure/cli@v2
+        uses: Azure/cli@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0
         with:
           azcliversion: ${{ env.AZCLIVERSION }}
           inlineScript: |
diff --git a/.github/workflows/Lighthouse.yml b/.github/workflows/Lighthouse.yml
index 0436e4fde..d2dc3ebd2 100644
--- a/.github/workflows/Lighthouse.yml
+++ b/.github/workflows/Lighthouse.yml
@@ -20,20 +20,20 @@ jobs:
   lighthouse:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4.1.1
+    - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
     - name: Prep file system
       run: mkdir ${{ env.outputdir }}
 
     - name: Lighthouse Checks
-      uses: foo-software/lighthouse-check-action@v10.0.0
+      uses: foo-software/lighthouse-check-action@f78f162ef0ecd48a18244c427959f0b79ef4d553 # v10.0.0
       id: lighthouseCheck
       with:
         urls: ${{ env.websiteUrl }}
         outputDirectory: ${{ env.outputdir }}
 
     - name: Upload Lighthouse report
-      uses: actions/upload-artifact@v4.3.1
+      uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
       with:
         name: Lighthouse reports
         path: ${{ env.outputdir }}
diff --git a/.github/workflows/PostDeploy.yml b/.github/workflows/PostDeploy.yml
index 38364cabb..9ec214bab 100644
--- a/.github/workflows/PostDeploy.yml
+++ b/.github/workflows/PostDeploy.yml
@@ -43,7 +43,7 @@ jobs:
       RG: "${{ inputs.RG }}"
       AKSNAME: "${{ inputs.AKSNAME }}"
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         name: Script file download
 
       - name: Job parameter inspection
@@ -53,7 +53,7 @@ jobs:
           echo "CertManager version is ${{ inputs.CERTMANAGERVERSION }}"
 
       - name: Azure Login
-        uses: azure/login@v2
+        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1
         with:
           creds: ${{ secrets.AZURE_CREDENTIALS }}
           enable-AzPSSession: false
diff --git a/.github/workflows/StandardCI.yml b/.github/workflows/StandardCI.yml
index bb0afd9e6..c52ebeee0 100644
--- a/.github/workflows/StandardCI.yml
+++ b/.github/workflows/StandardCI.yml
@@ -63,7 +63,7 @@ jobs:
 
     steps:
       #Get the code files from the repo
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Job parameter check
         run: |
@@ -87,14 +87,14 @@ jobs:
           }
 
       - name: Azure Login
-        uses: azure/login@v2
+        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
           subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
 
       - name: Validate Infrastructure deployment
-        uses: Azure/cli@v2
+        uses: Azure/cli@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0
         with:
           azcliversion: ${{ env.AZCLIVERSION }}
           inlineScript: |
@@ -119,10 +119,10 @@ jobs:
     environment: ${{ github.event.inputs.environment }}
     needs: [Deploy]
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Azure Login
-        uses: azure/login@v2
+        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1
         with:
           client-id: ${{ secrets.AZURE_CLIENT_ID }}
           tenant-id: ${{ secrets.AZURE_TENANT_ID }}
diff --git a/.github/workflows/Test_ReusableWorkflows.yml b/.github/workflows/Test_ReusableWorkflows.yml
index 9c9d10a26..6cfd498a8 100644
--- a/.github/workflows/Test_ReusableWorkflows.yml
+++ b/.github/workflows/Test_ReusableWorkflows.yml
@@ -63,7 +63,7 @@ jobs:
   Post-Deploy:
     needs: [SetupWF]
     if: false
-    uses: azure/aks-construction/.github/workflows/PostDeploy.yml@0.4.3
+    uses: azure/aks-construction/.github/workflows/PostDeploy.yml@1ec463b5598b05cd6561aeef9aad15f499582030 # 0.4.3
     with:
       RG: ${{ needs.SetupWF.outputs.RG }}
       AKSNAME: aks-Byo
@@ -76,7 +76,7 @@ jobs:
   byo-cluster:
     if: false
     needs: [SetupWF]
-    uses: azure/aks-construction/.github/workflows/AppDeploy_AzureVote.yml@0.4.3
+    uses: azure/aks-construction/.github/workflows/AppDeploy_AzureVote.yml@1ec463b5598b05cd6561aeef9aad15f499582030 # 0.4.3
     with:
       RG: ${{ needs.SetupWF.outputs.RG }}
       AKSNAME: aks-Byo
@@ -100,7 +100,7 @@ jobs:
         run: mkdir jsonout
 
       - name: Azure Login
-        uses: azure/login@v2
+        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1
         with:
           creds: ${{ secrets.AZURE_CREDENTIALS }}
           enable-AzPSSession: false
@@ -177,7 +177,7 @@ jobs:
 
       - name: Save Json output as Artifact
         if: always()
-        uses: actions/upload-artifact@v4.3.1
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
         with:
           name: Json out
           path: jsonout/*.json
@@ -185,7 +185,7 @@ jobs:
   deploy-azure-vote-app-lb:
     #needs: test-run-cmd
     if: false
-    uses: azure/aks-construction/.github/workflows/AppDeploy_AzureVote.yml@0.4.3
+    uses: azure/aks-construction/.github/workflows/AppDeploy_AzureVote.yml@1ec463b5598b05cd6561aeef9aad15f499582030 # 0.4.3
     with:
       RG: Automation-Actions-AksDeployCI #$RG
       AKSNAME: aks-Byo
@@ -201,7 +201,7 @@ jobs:
   deploy-azure-vote-app-ing:
     #needs: test-run-cmd
     if: false
-    uses: azure/aks-construction/.github/workflows/AppDeploy_AzureVote.yml@0.4.3
+    uses: azure/aks-construction/.github/workflows/AppDeploy_AzureVote.yml@1ec463b5598b05cd6561aeef9aad15f499582030 # 0.4.3
     with:
       RG: Automation-Actions-AksDeployCI
       AKSNAME: aks-Priva
@@ -227,7 +227,7 @@ jobs:
 
     name: Create extra bicep artifacts
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Set better name of artifact
         id: artifactName
@@ -281,7 +281,7 @@ jobs:
 
     name: Add extra release file-artifacts
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Verify File
         run: cat ${{ matrix.files }}
diff --git a/.github/workflows/bicepBuild.yml b/.github/workflows/bicepBuild.yml
index c129caa98..5de3397cb 100644
--- a/.github/workflows/bicepBuild.yml
+++ b/.github/workflows/bicepBuild.yml
@@ -16,7 +16,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: ContextCheck
         shell: pwsh
@@ -47,7 +47,7 @@ jobs:
 
           /home/runner/.azure/bin/bicep build bicep/main.bicep --outdir $compiledir
 
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         if: github.event_name != 'push'
         name: Git Checkout target
         with:
diff --git a/.github/workflows/brokenlinks.yml b/.github/workflows/brokenlinks.yml
index 9832a9c30..77a85e945 100644
--- a/.github/workflows/brokenlinks.yml
+++ b/.github/workflows/brokenlinks.yml
@@ -12,11 +12,11 @@ jobs:
   repoLinkChecker:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Link Checker
         id: lychee
-        uses: lycheeverse/lychee-action@v1.9.3
+        uses: lycheeverse/lychee-action@c053181aa0c3d17606addfe97a9075a32723548a # v1.9.3
         env:
           GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
         with:
@@ -25,7 +25,7 @@ jobs:
 
       - name: Create Issue From File
         if: steps.lychee.outputs.exit_code != 0
-        uses: peter-evans/create-issue-from-file@v5.0.0
+        uses: peter-evans/create-issue-from-file@24452a72d85239eacf1468b0f1982a9f3fec4c94 # v5.0.0
         with:
           title: 'Bot: Broken Links Detected in Repo'
           content-filepath: ./lychee/out.md
@@ -34,7 +34,7 @@ jobs:
   helperLinkChecker:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Playwright - Install w/ OS dependencies
         run: |
@@ -61,7 +61,7 @@ jobs:
 
       - name: Link Checker
         id: lychee
-        uses: lycheeverse/lychee-action@v1.9.3
+        uses: lycheeverse/lychee-action@c053181aa0c3d17606addfe97a9075a32723548a # v1.9.3
         env:
           GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
         with:
@@ -70,7 +70,7 @@ jobs:
 
       - name: Create Issue From File
         if: steps.lychee.outputs.exit_code != 0
-        uses: peter-evans/create-issue-from-file@v5.0.0
+        uses: peter-evans/create-issue-from-file@24452a72d85239eacf1468b0f1982a9f3fec4c94 # v5.0.0
         with:
           title: 'Bot: Broken Links Detected in AKSC Helper'
           content-filepath: ./lychee/out.md
diff --git a/.github/workflows/cleanupRg.yml b/.github/workflows/cleanupRg.yml
index 67dfbe449..f4bd3d534 100644
--- a/.github/workflows/cleanupRg.yml
+++ b/.github/workflows/cleanupRg.yml
@@ -30,7 +30,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: ${{ inputs.environment }}
     steps:
-    - uses: azure/login@v2
+    - uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1
       name: Login to Azure
       with:
         client-id: ${{ secrets.AZURE_CLIENT_ID }}
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 846cf6caa..481fc452a 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -38,11 +38,11 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4.1.1
+      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2.28.1
       with:
         languages: ${{ matrix.language }}
         # If you wish to specify custom queries, you can do so here or in a config file.
@@ -53,7 +53,7 @@ jobs:
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
+      uses: github/codeql-action/autobuild@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2.28.1
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -67,4 +67,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2.28.1
diff --git a/.github/workflows/ghpages.yml b/.github/workflows/ghpages.yml
index 6cc991136..096705395 100644
--- a/.github/workflows/ghpages.yml
+++ b/.github/workflows/ghpages.yml
@@ -47,9 +47,9 @@ jobs:
   Spelling:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
-      - uses: streetsidesoftware/cspell-action@v6.1.0
+      - uses: streetsidesoftware/cspell-action@ca4bb065dd09aca9c90c935f7dc9bb625985226c # v6.1.0
         name: Spell Check
         if: ${{github.event_name!='workflow_dispatch'}}
         with:
diff --git a/.github/workflows/ghpagesTest.yml b/.github/workflows/ghpagesTest.yml
index 67092dfa5..2f3575dd3 100644
--- a/.github/workflows/ghpagesTest.yml
+++ b/.github/workflows/ghpagesTest.yml
@@ -35,7 +35,7 @@ jobs:
       cancel-in-progress: true
       group: FullDeploy${{ !github.event.pull_request.head.repo.fork && ( inputs.doAzCmdDeployment == 'true' || contains( github.event.pull_request.labels.*.name, 'test-deploy-wizard')) }}
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Build and start node app (targeting Bicep in MAIN)
         if: inputs.REACT_APP_TEMPLATERELEASE == ''
@@ -102,7 +102,7 @@ jobs:
 
       - name: Html Broken Link Checker
         id: lychee
-        uses: lycheeverse/lychee-action@v1.7.0
+        uses: lycheeverse/lychee-action@97189f2c0a3c8b0cb0e704fd4e878af6e5e2b2c5 # v1.7.0
         env:
           GITHUB_TOKEN: ${{secrets.GITHUB_TOKEN}}
         with:
@@ -112,7 +112,7 @@ jobs:
 
       - name: Persist exported Az Commands for visibility
         if: ${{ github.event.pull_request.head.repo.fork }}
-        uses: actions/upload-artifact@v4.3.1
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
         with:
           name: AzCmds
           path: helper/azcmd-*.sh
@@ -141,7 +141,7 @@ jobs:
 
       - name: Azure Login
         if: ${{ !github.event.pull_request.head.repo.fork }}
-        uses: azure/login@v2
+        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1
         with:
           creds: ${{ secrets.AZURE_CREDENTIALS }}
           enable-AzPSSession: true
@@ -150,7 +150,7 @@ jobs:
       #TODO: If/When we capture more AZ CMD's, then we'll want to iterate over files beginning with "azcmd"
       - name: Verify AZ Commands
         if: ${{ !github.event.pull_request.head.repo.fork }}
-        uses: Azure/cli@v2
+        uses: Azure/cli@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0
         env:
           azcmdpath: "helper/azcmd-managed-private.sh"
         with:
@@ -171,7 +171,7 @@ jobs:
 
       - name: Full deploy test AZ Commands
         if: ${{ !github.event.pull_request.head.repo.fork && ( inputs.doAzCmdDeployment == 'true' || contains( github.event.pull_request.labels.*.name, 'test-deploy-wizard')) }}
-        uses: Azure/cli@v2
+        uses: Azure/cli@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0
         env:
           azcmdpath: "helper/azcmd-managed-private.sh"
         with:
@@ -190,14 +190,14 @@ jobs:
             #az deploymentg group delete -n ghpages  -g $RG
 
       - name: Persist test failure screengrabs as artifacts
-        uses: actions/upload-artifact@v4.3.1
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
         if: failure()
         with:
           name: TestFailScreengrabs
           path: helper/failscreengrabs/*.png
 
       - name: Persist always screengrabs as artifacts
-        uses: actions/upload-artifact@v4.3.1
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
         if: always()
         with:
           name: Screengrabs
diff --git a/.github/workflows/greetings.yml b/.github/workflows/greetings.yml
index fd2c6de8e..bf8bf7980 100644
--- a/.github/workflows/greetings.yml
+++ b/.github/workflows/greetings.yml
@@ -9,7 +9,7 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-    - uses: actions/first-interaction@v1.3.0
+    - uses: actions/first-interaction@34f15e814fe48ac9312ccf29db4e74fa767cbab7 # v1.3.0
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         issue-message: 'Thanks for raising your first issue, the team appreciates the time you have taken 😉'
diff --git a/.github/workflows/markdownchecks.yml b/.github/workflows/markdownchecks.yml
index a0d0af658..2bbe624b2 100644
--- a/.github/workflows/markdownchecks.yml
+++ b/.github/workflows/markdownchecks.yml
@@ -5,14 +5,14 @@ jobs:
   Validation:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Typo file contents check
         shell: bash
         run: cat ./.github/workflows_dep/_typos.toml
 
       - name: Check spelling of markdown files
-        uses: crate-ci/typos@v1.20.6
+        uses: crate-ci/typos@c0d730e33e3af53c65d50de63ced5f75363593ee # v1.20.6
         with:
           files: ./*.md
           config: ./.github/workflows_dep/_typos.toml
diff --git a/.github/workflows/regressionparams.yml b/.github/workflows/regressionparams.yml
index b3c411a25..369aa3a66 100644
--- a/.github/workflows/regressionparams.yml
+++ b/.github/workflows/regressionparams.yml
@@ -36,7 +36,7 @@ jobs:
       FILELIST: ${{ steps.getfiles.outputs.FILELIST}}
     steps:
       #Get the code files from the repo
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Job parameter check
         run: |
@@ -63,7 +63,7 @@ jobs:
 
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Job parameter check
         run: |
@@ -122,7 +122,7 @@ jobs:
           $params | ConvertTo-Json -Depth 4 | Out-File "${{ env.ParamDir }}${{ matrix.files }}"
 
       - name: Azure Login
-        uses: Azure/login@v2
+        uses: Azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1
         with:
           creds: ${{ secrets.AZURE_CREDENTIALS }}
           enable-AzPSSession: false
@@ -130,7 +130,7 @@ jobs:
           allow-no-subscriptions: false
 
       - name: Validate Infrastructure deployment
-        uses: Azure/cli@v2
+        uses: Azure/cli@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0
         with:
           azcliversion: ${{ env.AZCLIVERSION }}
           inlineScript: |
@@ -140,7 +140,7 @@ jobs:
       - name: WhatIf Infrastructure deployment
         if: steps.paramfile.outputs.DOPSRULE == 'true'
         continue-on-error: ${{ secrets.ISAZCLIWHATIFUNRELIABLE == 'true' }}
-        uses: Azure/cli@v2
+        uses: Azure/cli@9f7ce6f37c31b777ec6c6b6d1dfe7db79f497956 # v2.2.0
         with:
           azcliversion: ${{ env.AZCLIVERSION }}
           inlineScript: |
@@ -152,7 +152,7 @@ jobs:
       # https://azure.github.io/PSRule.Rules.Azure/
       - name: PSRule - Analyze Azure parameter file
         if: steps.paramfile.outputs.DOPSRULE == 'true'
-        uses: microsoft/ps-rule@v2.9.0
+        uses: microsoft/ps-rule@46451b8f5258c41beb5ae69ed7190ccbba84112c # v2.9.0
         continue-on-error: true #Setting this whilst PSRule gets bedded in, in this project
         with:
           modules: 'PSRule.Rules.Azure'
@@ -162,7 +162,7 @@ jobs:
 
       - name: PSRule - Analyze Azure parameter file including Preview feature rulesets
         if: steps.paramfile.outputs.DOPSRULE == 'true'
-        uses: microsoft/ps-rule@v2.9.0
+        uses: microsoft/ps-rule@46451b8f5258c41beb5ae69ed7190ccbba84112c # v2.9.0
         continue-on-error: true #Preview feature checking means we need to suppress errors
         with:
           modules: 'PSRule.Rules.Azure'
diff --git a/.github/workflows/release-soft.yml b/.github/workflows/release-soft.yml
index b1fc92e97..9d4be8c84 100644
--- a/.github/workflows/release-soft.yml
+++ b/.github/workflows/release-soft.yml
@@ -17,7 +17,7 @@ jobs:
     outputs:
       LatestAkscVersionTag: ${{ steps.AkscTags.outputs.LATEST}}
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           fetch-depth: 0
 
@@ -106,14 +106,14 @@ jobs:
     env:
       templateRelease: ${{ needs.VerifySoftPossible.outputs.LatestAkscVersionTag }}
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Job Parameter Checking
         run: |
           echo "GitHub Ref: ${{ github.ref }}"
 
       - name: Azure Login
-        uses: azure/login@v2
+        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1
         with:
           creds: ${{ secrets.AZURE_CREDENTIALS }}
 
@@ -131,7 +131,7 @@ jobs:
           REACT_APP_APPINSIGHTS_KEY=${{ secrets.REACT_APP_APPINSIGHTS_KEY}} REACT_APP_TEMPLATERELEASE="${{env.templateRelease}}"  npm run build
 
       - name: Create GitHub pages release artifact
-        uses: actions/upload-artifact@v4.3.1
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
         with:
           name: HelperApp
           path: helper/build
@@ -143,13 +143,13 @@ jobs:
     env:
       templateRelease: ${{ needs.VerifySoftPossible.outputs.LatestAkscVersionTag }}
     steps:
-      - uses: actions/download-artifact@v4.1.4
+      - uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
         with:
           name: HelperApp
           path: helperapp
 
       - name: Deploy to GitHub Pages Canary
-        uses: crazy-max/ghaction-github-pages@v4.0.0
+        uses: crazy-max/ghaction-github-pages@c05ee637ec73429400a359430db8e5629f3f2564 # v4.0.0
         with:
           target_branch: gh-pages-canary
           commit_message: Pages Release. Canary ${{env.templateRelease}}
@@ -167,13 +167,13 @@ jobs:
     env:
       templateRelease: ${{ needs.VerifySoftPossible.outputs.LatestAkscVersionTag }}
     steps:
-      - uses: actions/download-artifact@v4.1.4
+      - uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
         with:
           name: HelperApp
           path: helperapp
 
       - name: Deploy to GitHub Pages Prod
-        uses: crazy-max/ghaction-github-pages@v4.0.0
+        uses: crazy-max/ghaction-github-pages@c05ee637ec73429400a359430db8e5629f3f2564 # v4.0.0
         with:
           target_branch: gh-pages
           commit_message: Pages Release. Prod ${{env.templateRelease}}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e4e08db67..ccae6b0a9 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -46,14 +46,14 @@ jobs:
     runs-on: ubuntu-latest
     name: Build Web App
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Job Parameter Checking
         run: |
           echo "GitHub Ref: ${{ github.ref }}"
 
       - name: Azure Login
-        uses: azure/login@v2
+        uses: azure/login@7184910d9eb2b1c5e48f7073824a90609bb9b6d6 # v2.3.1
         with:
           creds: ${{ secrets.AZURE_CREDENTIALS }}
 
@@ -71,7 +71,7 @@ jobs:
           REACT_APP_APPINSIGHTS_KEY=${{ secrets.REACT_APP_APPINSIGHTS_KEY}} REACT_APP_TEMPLATERELEASE="${{env.templateRelease}}"  npm run build
 
       - name: Create GitHub pages release artifact
-        uses: actions/upload-artifact@v4.3.1
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
         with:
           name: HelperApp
           path: helper/build
@@ -81,7 +81,7 @@ jobs:
     name: Create GitHub Release (bicep)
     if: ${{ github.event.inputs.createRelease == 'true' }}
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Check that the GitHub release does not already exist
         run: |
@@ -116,7 +116,7 @@ jobs:
           /home/runner/.azure/bin/bicep build bicep/main.bicep --outdir $compiledir
 
       - name: Create Bicep release artifact
-        uses: actions/upload-artifact@v4.3.1
+        uses: actions/upload-artifact@5d5d22a31266ced268874388b861e4b58bb5c2f3 # v4.3.1
         with:
           name: CompiledBicep
           path: bicep/compiled/main.json
@@ -142,7 +142,7 @@ jobs:
     name: Add extra release file-artifacts
     if: ${{ github.event.inputs.createRelease == 'true' }}
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Verify File
         run: cat ${{ matrix.files }}
@@ -166,7 +166,7 @@ jobs:
     name: Create extra bicep artifacts
     if: ${{ github.event.inputs.createRelease == 'true' }}
     steps:
-      - uses: actions/checkout@v4.1.1
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
 
       - name: Set better name of artifact
         id: artifactName
@@ -214,20 +214,20 @@ jobs:
     if: ${{ always() }}
     needs: [BuildWebApp , CreateRelease, CreateExtraBicepArtifacts, TestWebApp]
     steps:
-      - uses: actions/download-artifact@v4.1.4
+      - uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
         with:
           name: HelperApp
           path: helperapp
 
       #Although we don't need this artifact, if it's missing then we can abort this job
-      - uses: actions/download-artifact@v4.1.4
+      - uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
         if: ${{ github.event.inputs.createRelease == 'true' }}
         with:
           name: CompiledBicep
           path: compilebicep
 
       - name: Deploy to GitHub Pages Canary
-        uses: crazy-max/ghaction-github-pages@v4.0.0
+        uses: crazy-max/ghaction-github-pages@c05ee637ec73429400a359430db8e5629f3f2564 # v4.0.0
         with:
           target_branch: gh-pages-canary
           commit_message: Pages Release. Canary ${{env.templateRelease}}
@@ -243,20 +243,20 @@ jobs:
     environment: UI-Deploy-Manual-Approval
     needs: [BuildWebApp , CreateRelease, DeployWebAppToCanary]
     steps:
-      - uses: actions/download-artifact@v4.1.4
+      - uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
         with:
           name: HelperApp
           path: helperapp
 
       #Although we don't need this artifact, if it's missing then we can abort this job
-      - uses: actions/download-artifact@v4.1.4
+      - uses: actions/download-artifact@c850b930e6ba138125429b7e5c93fc707a7f8427 # v4.1.4
         if: ${{ github.event.inputs.createRelease == 'true' }}
         with:
           name: CompiledBicep
           path: compilebicep
 
       - name: Deploy to GitHub Pages Prod
-        uses: crazy-max/ghaction-github-pages@v4.0.0
+        uses: crazy-max/ghaction-github-pages@c05ee637ec73429400a359430db8e5629f3f2564 # v4.0.0
         with:
           target_branch: gh-pages
           commit_message: Pages Release. Prod ${{env.templateRelease}}
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 7d2ba30f1..5d5941cf7 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -23,7 +23,7 @@ jobs:
       pull-requests: write
 
     steps:
-    - uses: actions/stale@v9.0.0
+    - uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9.0.0
       with:
         repo-token: ${{ secrets.GITHUB_TOKEN }}
         stale-issue-message: 'Issue smells stale, no activity for 30 days. Stale Label will be removed if the issue is updated, otherwise closed in a month.'