diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 2424134..44e1175 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -20,7 +20,7 @@ permissions:
 jobs:
   dotnet:
     name: .NET Build & Test
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-dotnet.yaml@main
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-dotnet.yaml@786dcfe8d95af8e640a76b09f30d2c0e86792157 # main
     with:
       working-directory: api
       solution: ProposalSystem.sln
@@ -30,7 +30,7 @@ jobs:
     # Phase 5: full frontend pipeline — format:check, build (tsc -b included),
     # vitest, Playwright chromium smoke. Replaces the old typecheck-only job
     # plus the standalone Web Tests job. No lint script yet (run-lint: false).
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-frontend.yaml@main
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-frontend.yaml@786dcfe8d95af8e640a76b09f30d2c0e86792157 # main
     with:
       working-directory: web
       cache-dependency-path: web/package-lock.json
@@ -40,7 +40,7 @@ jobs:
 
   python:
     name: Python Lint
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml@main
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml@786dcfe8d95af8e640a76b09f30d2c0e86792157 # main
     with:
       source-dirs: "lambdas/"
       run-sam-validate: false
@@ -68,7 +68,7 @@ jobs:
 
   mobile:
     name: Mobile Typecheck
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@main
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@786dcfe8d95af8e640a76b09f30d2c0e86792157 # main
     with:
       working-directory: mobile
       cache-dependency-path: mobile/package-lock.json
@@ -78,7 +78,7 @@ jobs:
 
   infra:
     name: CDK Synth
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@main
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@786dcfe8d95af8e640a76b09f30d2c0e86792157 # main
     with:
       working-directory: infra
       cache-dependency-path: infra/package-lock.json
diff --git a/.github/workflows/deploy-mobile.yaml b/.github/workflows/deploy-mobile.yaml
index f8d73e6..639eaf8 100644
--- a/.github/workflows/deploy-mobile.yaml
+++ b/.github/workflows/deploy-mobile.yaml
@@ -15,7 +15,7 @@ permissions:
 jobs:
   deploy-ios:
     name: Build & Upload to TestFlight
-    uses: Sea-Haven-Industries/.github/.github/workflows/cd-mobile-ios.yaml@main
+    uses: Sea-Haven-Industries/.github/.github/workflows/cd-mobile-ios.yaml@786dcfe8d95af8e640a76b09f30d2c0e86792157 # main
     with:
       working-directory: mobile
       cache-dependency-path: mobile/package-lock.json
diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index 50c170e..062cced 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -15,7 +15,7 @@ permissions:
 jobs:
   deploy:
     name: Deploy to AWS
-    uses: Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml@main
+    uses: Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml@786dcfe8d95af8e640a76b09f30d2c0e86792157 # main
     with:
       cdk-dir: infra
       dotnet-version: "8.0.x"
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index 4af423a..ea6df63 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -8,4 +8,4 @@ permissions:
   issues: write
 jobs:
   label:
-    uses: Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml@main
+    uses: Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml@786dcfe8d95af8e640a76b09f30d2c0e86792157 # main