diff --git a/.github/workflows/check.yml b/.github/workflows/check.yml
index e7783e7..cac2e15 100644
--- a/.github/workflows/check.yml
+++ b/.github/workflows/check.yml
@@ -14,8 +14,8 @@ jobs:
           - "3.13"
           - "3.12"
     steps:
-      - uses: actions/checkout@v7
-      - uses: jdx/mise-action@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
         with:
           tool_versions: |
             python ${{ matrix.python-version }}
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index dcf9344..ad8415b 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -10,8 +10,8 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: jdx/mise-action@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
+      - uses: jdx/mise-action@7e36c90d9ab29c415a2384db3006f3ec8a8cc654 # v4.2.4
       - name: Configure Git Credentials
         run: |
           git config user.name github-actions[bot]
diff --git a/.jules/sentinel.md b/.jules/sentinel.md
index de39893..6cad117 100644
--- a/.jules/sentinel.md
+++ b/.jules/sentinel.md
@@ -1,3 +1,8 @@
 # Sentinel Security Journal
 
 This journal contains critical security learnings specific to this project.
+
+## 2026-03-10 - Secure GitHub Actions Pinned to Immutable SHAs
+**Vulnerability:** Workflows were referencing a non-existent version tag `actions/checkout@v7` and a mutable major version tag `jdx/mise-action@v4`. Using non-existent or moving tags exposes the repository to supply chain and tag-spoofing attacks if an attacker registers or hijacks the version tag.
+**Learning:** Third-party actions should not rely on moving major version tags or non-existent tags. Moving tags are mutable, and their associated commits can change, potentially introducing untested or malicious code.
+**Prevention:** Pin all third-party GitHub Actions to secure, immutable 40-character full-length commit SHAs, and append a comment indicating the human-readable version (e.g. `# v4.4.0`). Dependabot can then be configured to automatically update these SHAs.