diff --git a/.github/workflows/_finish.yml b/.github/workflows/_finish.yml
index 2230e5bdf1c3d..f7912b1c93b12 100644
--- a/.github/workflows/_finish.yml
+++ b/.github/workflows/_finish.yml
@@ -36,7 +36,7 @@ jobs:
       actions: read
       contents: read
     steps:
-    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/jq@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       name: Incoming data
       id: needs
       with:
@@ -87,7 +87,7 @@ jobs:
                    summary: "Check has finished",
                    text: $text}}}}
 
-    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/jq@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       name: Print summary
       with:
         input: ${{ toJSON(steps.needs.outputs.value).summary-title }}
@@ -95,13 +95,13 @@ jobs:
           "## \(.)"
         options: -Rr
         output-path: GITHUB_STEP_SUMMARY
-    - uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/appauth@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       name: Appauth
       id: appauth
       with:
         app_id: ${{ secrets.app-id }}
         key: ${{ secrets.app-key }}
-    - uses: envoyproxy/toolshed/gh-actions/github/checks@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/github/checks@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       name: Update check
       with:
         action: update
diff --git a/.github/workflows/_load.yml b/.github/workflows/_load.yml
index 34b9a8518946b..768be09ba7761 100644
--- a/.github/workflows/_load.yml
+++ b/.github/workflows/_load.yml
@@ -91,7 +91,7 @@ jobs:
     # Handle any failure in triggering job
     # Remove any `checks` we dont care about
     # Prepare a check request
-    - uses: envoyproxy/toolshed/gh-actions/github/env/load@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/github/env/load@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       name: Load env
       id: data
       with:
@@ -102,13 +102,13 @@ jobs:
         GH_TOKEN: ${{ github.token }}
 
     #  Update the check
-    - uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/appauth@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       name: Appauth
       id: appauth
       with:
         app_id: ${{ secrets.app-id }}
         key: ${{ secrets.app-key }}
-    - uses: envoyproxy/toolshed/gh-actions/github/checks@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/github/checks@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       name: Update check
       if: ${{ fromJSON(steps.data.outputs.data).data.check.action == 'RUN' }}
       with:
@@ -116,7 +116,7 @@ jobs:
         checks: ${{ toJSON(fromJSON(steps.data.outputs.data).checks) }}
         token: ${{ steps.appauth.outputs.token }}
 
-    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/jq@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       name: Print request summary
       with:
         input: |
@@ -136,7 +136,7 @@ jobs:
           | $summary.summary as $summary
           | "${{ inputs.template-request-summary }}"
 
-    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/jq@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       id: request-output
       name: Load request
       with:
diff --git a/.github/workflows/_load_env.yml b/.github/workflows/_load_env.yml
index 16035d4cc5d7b..24d3402bf2b29 100644
--- a/.github/workflows/_load_env.yml
+++ b/.github/workflows/_load_env.yml
@@ -63,18 +63,18 @@ jobs:
       request: ${{ steps.env.outputs.data }}
       trusted: true
     steps:
-    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/jq@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       id: started
       name: Create timestamp
       with:
         options: -r
         filter: |
           now
-    - uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/github/checkout@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       id: checkout
       name: Checkout Envoy repository
     - name: Generate environment variables
-      uses: envoyproxy/toolshed/gh-actions/envoy/ci/env@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/envoy/ci/env@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       id: env
       with:
         branch-name: ${{ inputs.branch-name }}
@@ -86,7 +86,7 @@ jobs:
 
     - name: Request summary
       id: summary
-      uses: envoyproxy/toolshed/gh-actions/github/env/summary@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/github/env/summary@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       with:
         actor: ${{ toJSON(fromJSON(steps.env.outputs.data).request.actor) }}
         base-sha: ${{ fromJSON(steps.env.outputs.data).request.base-sha }}
diff --git a/.github/workflows/_request.yml b/.github/workflows/_request.yml
index a7e96ccc3620c..d3afbaf9b562f 100644
--- a/.github/workflows/_request.yml
+++ b/.github/workflows/_request.yml
@@ -40,14 +40,14 @@ jobs:
       env: ${{ steps.data.outputs.value }}
       config: ${{ steps.config.outputs.config }}
     steps:
-    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/jq@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       id: started
       name: Create timestamp
       with:
         options: -r
         filter: |
           now
-    - uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/github/checkout@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       id: checkout
       name: Checkout Envoy repository
       with:
@@ -60,7 +60,7 @@ jobs:
     # *ALL* variables collected should be treated as untrusted and should be sanitized before
     # use
     - name: Generate environment variables from commit
-      uses: envoyproxy/toolshed/gh-actions/envoy/ci/request@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/envoy/ci/request@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       id: env
       with:
         branch-name: ${{ steps.checkout.outputs.branch-name }}
@@ -71,7 +71,7 @@ jobs:
         vars: ${{ toJSON(vars) }}
     - name: Request summary
       id: summary
-      uses: envoyproxy/toolshed/gh-actions/github/env/summary@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/github/env/summary@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       with:
         actor: ${{ toJSON(fromJSON(steps.env.outputs.data).request.actor) }}
         base-sha: ${{ fromJSON(steps.env.outputs.data).request.base-sha }}
@@ -87,7 +87,7 @@ jobs:
         target-branch: ${{ fromJSON(steps.env.outputs.data).request.target-branch }}
 
     - name: Environment data
-      uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/jq@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       id: data
       with:
         input: |
diff --git a/.github/workflows/_run.yml b/.github/workflows/_run.yml
index 5c4d38e3507f3..86bd7b159b2e4 100644
--- a/.github/workflows/_run.yml
+++ b/.github/workflows/_run.yml
@@ -158,7 +158,7 @@ jobs:
     name: ${{ inputs.command }} ${{ inputs.target }}
     timeout-minutes: ${{ inputs.timeout-minutes }}
     steps:
-    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/jq@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       id: started
       name: Create timestamp
       with:
@@ -166,7 +166,7 @@ jobs:
         filter: |
           now
     # This controls which input vars are exposed to the run action (and related steps)
-    - uses: envoyproxy/toolshed/gh-actions/jq@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/jq@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       name: Context
       id: context
       with:
@@ -187,11 +187,11 @@ jobs:
           | . * {$config, $check}
     - if: ${{ inputs.cache-build-image }}
       name: Restore Docker cache ${{ inputs.cache-build-image && format('({0})', inputs.cache-build-image) || '' }}
-      uses: envoyproxy/toolshed/gh-actions/docker/cache/restore@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/docker/cache/restore@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       with:
         image_tag: ${{ inputs.cache-build-image }}
 
-    - uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/appauth@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       id: appauth
       name: Appauth
       if: ${{ inputs.trusted }}
@@ -202,7 +202,7 @@ jobs:
         # - the workaround is to allow the token to be passed through.
         token: ${{ github.token }}
         token-ok: true
-    - uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/github/checkout@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       id: checkout
       name: Checkout Envoy repository
       with:
@@ -219,7 +219,7 @@ jobs:
         token: ${{ inputs.trusted && steps.appauth.outputs.token || github.token }}
 
     # This is currently only use by mobile-docs and can be removed once they are updated to the newer website
-    - uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/github/checkout@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       id: checkout-extra
       name: Checkout extra repository (for publishing)
       if: ${{ inputs.checkout-extra }}
@@ -227,7 +227,7 @@ jobs:
         config: ${{ inputs.checkout-extra }}
         ssh-key: ${{ inputs.trusted && inputs.ssh-key-extra || '' }}
 
-    - uses: envoyproxy/toolshed/gh-actions/github/run@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/github/run@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       name: Run CI ${{ inputs.command }} ${{ inputs.target }}
       with:
         args: ${{ inputs.args != '--' && inputs.args || inputs.target }}
diff --git a/.github/workflows/codeql-daily.yml b/.github/workflows/codeql-daily.yml
index 0d8347258ed3a..dede30da168e8 100644
--- a/.github/workflows/codeql-daily.yml
+++ b/.github/workflows/codeql-daily.yml
@@ -30,7 +30,7 @@ jobs:
       uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29  # v4.1.6
 
     - name: Free disk space
-      uses: envoyproxy/toolshed/gh-actions/diskspace@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/diskspace@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       with:
         to_remove: |
           /usr/local/lib/android
diff --git a/.github/workflows/codeql-push.yml b/.github/workflows/codeql-push.yml
index 4a82d699b2164..1b0fe7943fdf7 100644
--- a/.github/workflows/codeql-push.yml
+++ b/.github/workflows/codeql-push.yml
@@ -61,7 +61,7 @@ jobs:
 
     - name: Free disk space
       if: ${{ env.BUILD_TARGETS != '' }}
-      uses: envoyproxy/toolshed/gh-actions/diskspace@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/diskspace@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       with:
         to_remove: |
           /usr/local/lib/android
diff --git a/.github/workflows/command.yml b/.github/workflows/command.yml
index cc59d5ceefe45..a915b09e8a1fc 100644
--- a/.github/workflows/command.yml
+++ b/.github/workflows/command.yml
@@ -28,7 +28,7 @@ jobs:
          && github.actor != 'dependabot[bot]'
       }}
     steps:
-    - uses: envoyproxy/toolshed/gh-actions/github/command@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/github/command@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       name: Parse command from comment
       id: command
       with:
@@ -37,14 +37,14 @@ jobs:
           ^/(retest)
 
     # /retest
-    - uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/appauth@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       if: ${{ steps.command.outputs.command == 'retest' }}
       id: appauth-retest
       name: Appauth (retest)
       with:
         key: ${{ secrets.ENVOY_CI_APP_KEY }}
         app_id: ${{ secrets.ENVOY_CI_APP_ID }}
-    - uses: envoyproxy/toolshed/gh-actions/retest@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/retest@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       if: ${{ steps.command.outputs.command == 'retest' }}
       name: Retest
       with:
diff --git a/.github/workflows/envoy-dependency.yml b/.github/workflows/envoy-dependency.yml
index e4ac073bc015d..2d7113eaf6682 100644
--- a/.github/workflows/envoy-dependency.yml
+++ b/.github/workflows/envoy-dependency.yml
@@ -53,16 +53,16 @@ jobs:
     steps:
     - id: appauth
       name: Appauth
-      uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/appauth@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       with:
         app_id: ${{ secrets.ENVOY_CI_DEP_APP_ID }}
         key: ${{ secrets.ENVOY_CI_DEP_APP_KEY }}
     - id: checkout
       name: Checkout Envoy repository
-      uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/github/checkout@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       with:
         token: ${{ steps.appauth.outputs.token }}
-    - uses: envoyproxy/toolshed/gh-actions/bson@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/bson@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       id: update
       name: Update dependency (${{ inputs.dependency }})
       with:
@@ -97,13 +97,13 @@ jobs:
       env:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-    - uses: envoyproxy/toolshed/gh-actions/upload/diff@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/upload/diff@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       name: Upload diff
       with:
         name: ${{ inputs.dependency }}-${{ steps.update.outputs.output }}
     - name: Create a PR
       if: ${{ inputs.pr }}
-      uses: envoyproxy/toolshed/gh-actions/github/pr@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/github/pr@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       with:
         base: main
         body: |
@@ -134,11 +134,11 @@ jobs:
     steps:
     - id: appauth
       name: Appauth
-      uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/appauth@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       with:
         app_id: ${{ secrets.ENVOY_CI_DEP_APP_ID }}
         key: ${{ secrets.ENVOY_CI_DEP_APP_KEY }}
-    - uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/github/checkout@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       id: checkout
       name: Checkout Envoy repository
       with:
@@ -180,7 +180,7 @@ jobs:
 
     - name: Check Docker SHAs
       id: build-images
-      uses: envoyproxy/toolshed/gh-actions/docker/shas@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/docker/shas@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       with:
         images: |
            sha: envoyproxy/envoy-build-ubuntu:${{ steps.build-tools.outputs.tag }}
@@ -209,7 +209,7 @@ jobs:
       name: Update SHAs
       working-directory: envoy
     - name: Create a PR
-      uses: envoyproxy/toolshed/gh-actions/github/pr@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/github/pr@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       with:
         base: main
         body: Created by Envoy dependency bot
diff --git a/.github/workflows/envoy-release.yml b/.github/workflows/envoy-release.yml
index 00351f8304f90..adcfa9b2049a7 100644
--- a/.github/workflows/envoy-release.yml
+++ b/.github/workflows/envoy-release.yml
@@ -55,14 +55,14 @@ jobs:
     steps:
     - id: appauth
       name: App auth
-      uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/appauth@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       with:
         app_id: ${{ secrets.ENVOY_CI_PUBLISH_APP_ID }}
         key: ${{ secrets.ENVOY_CI_PUBLISH_APP_KEY }}
 
     - id: checkout
       name: Checkout Envoy repository
-      uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/github/checkout@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       with:
         committer-name: ${{ env.COMMITTER_NAME }}
         committer-email: ${{ env.COMMITTER_EMAIL }}
@@ -83,10 +83,10 @@ jobs:
       name: Check changelog summary
     - if: ${{ inputs.author }}
       name: Validate signoff email
-      uses: envoyproxy/toolshed/gh-actions/email/validate@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/email/validate@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       with:
         email: ${{ inputs.author }}
-    - uses: envoyproxy/toolshed/gh-actions/github/run@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/github/run@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       name: Create release
       with:
         source: |
@@ -111,7 +111,7 @@ jobs:
       name: Release version
       id: release
     - name: Create a PR
-      uses: envoyproxy/toolshed/gh-actions/github/pr@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/github/pr@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       with:
         base: ${{ github.ref_name }}
         commit: false
@@ -136,20 +136,20 @@ jobs:
     steps:
     - id: appauth
       name: App auth
-      uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/appauth@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       with:
         app_id: ${{ secrets.ENVOY_CI_PUBLISH_APP_ID }}
         key: ${{ secrets.ENVOY_CI_PUBLISH_APP_KEY }}
 
     - id: checkout
       name: Checkout Envoy repository
-      uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/github/checkout@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       with:
         committer-name: ${{ env.COMMITTER_NAME }}
         committer-email: ${{ env.COMMITTER_EMAIL }}
         strip-prefix: release/
         token: ${{ steps.appauth.outputs.token }}
-    - uses: envoyproxy/toolshed/gh-actions/github/run@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/github/run@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       name: Sync version histories
       with:
         command: >-
@@ -159,7 +159,7 @@ jobs:
           --
           --signoff="${{ env.COMMITTER_NAME }} <${{ env.COMMITTER_EMAIL }}>"
     - name: Create a PR
-      uses: envoyproxy/toolshed/gh-actions/github/pr@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/github/pr@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       with:
         append-commit-message: true
         base: ${{ github.ref_name }}
@@ -189,13 +189,13 @@ jobs:
     steps:
     - id: appauth
       name: App auth
-      uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/appauth@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       with:
         app_id: ${{ secrets.ENVOY_CI_PUBLISH_APP_ID }}
         key: ${{ secrets.ENVOY_CI_PUBLISH_APP_KEY }}
 
     - name: Checkout repository
-      uses: envoyproxy/toolshed/gh-actions/github/checkout@actions-v0.2.30
+      uses: envoyproxy/toolshed/gh-actions/github/checkout@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       with:
         committer-name: ${{ env.COMMITTER_NAME }}
         committer-email: ${{ env.COMMITTER_EMAIL }}
diff --git a/.github/workflows/envoy-sync.yml b/.github/workflows/envoy-sync.yml
index b98f5a82ad3a7..c8077dcb976f5 100644
--- a/.github/workflows/envoy-sync.yml
+++ b/.github/workflows/envoy-sync.yml
@@ -31,12 +31,12 @@ jobs:
         - data-plane-api
         - mobile-website
     steps:
-    - uses: envoyproxy/toolshed/gh-actions/appauth@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/appauth@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       id: appauth
       with:
         app_id: ${{ secrets.ENVOY_CI_SYNC_APP_ID }}
         key: ${{ secrets.ENVOY_CI_SYNC_APP_KEY }}
-    - uses: envoyproxy/toolshed/gh-actions/dispatch@actions-v0.2.30
+    - uses: envoyproxy/toolshed/gh-actions/dispatch@69c6547c3948bdb46b42c5ad8a57c133967b27bc # actions-v0.2.30
       with:
         repository: "envoyproxy/${{ matrix.downstream }}"
         ref: main
diff --git a/.github/workflows/request.yml b/.github/workflows/request.yml
index a245052db14a4..bd5b2e9a03421 100644
--- a/.github/workflows/request.yml
+++ b/.github/workflows/request.yml
@@ -24,7 +24,7 @@ jobs:
   request:
     # For branches this can be pinned to a specific version if required
     # NB: `uses` cannot be dynamic so it _must_ be hardcoded anywhere it is read
-    uses: envoyproxy/envoy/.github/workflows/_request.yml@main
+    uses: envoyproxy/envoy/.github/workflows/_request.yml@64cb65c7d1a1b8d1d779ac2424ac530addac5762 # main
     if: ${{ vars.ENVOY_CI || github.repository == 'envoyproxy/envoy' }}
     permissions:
       actions: read