diff --git a/.github/actions/build-base-image/action.yaml b/.github/actions/build-base-image/action.yaml
index a35115c0c0ae..b7d27af44eb9 100644
--- a/.github/actions/build-base-image/action.yaml
+++ b/.github/actions/build-base-image/action.yaml
@@ -47,7 +47,7 @@ runs:
         run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
 
       - name: Cache BASE image
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # ratchet:actions/cache@v5.0.3
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         if: inputs.TYPE == '64-bit' || inputs.TYPE == 'clang'
         with:
             path: otp_docker_base.tar
@@ -70,7 +70,7 @@ runs:
       - name: Cache pre-built src
         id: cache-src
         if: inputs.BUILD_IMAGE == 'true'
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # ratchet:actions/cache@v5.0.3
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
             path: otp_src.tar.gz
             key: prebuilt-src-${{ github.ref_name }}-${{ github.sha }}
@@ -84,7 +84,7 @@ runs:
       - name: Cache pre-built binaries
         id: cache-binary
         if: inputs.BUILD_IMAGE == 'true' && steps.cache-src.outputs.cache-hit == 'true'
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # ratchet:actions/cache@v5.0.3
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
             path: otp_cache.tar.gz
             key: prebuilt-cache-${{ inputs.TYPE }}-${{ github.ref_name }}-${{ github.sha }}
diff --git a/.github/actions/ossf-compiler-flags-scanner/action.yaml b/.github/actions/ossf-compiler-flags-scanner/action.yaml
index 143a9a4ad69d..a8a9857960d4 100644
--- a/.github/actions/ossf-compiler-flags-scanner/action.yaml
+++ b/.github/actions/ossf-compiler-flags-scanner/action.yaml
@@ -28,7 +28,7 @@ inputs:
 runs:
     using: composite
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
             repository: ossf/wg-best-practices-os-developers
             sparse-checkout: docs/Compiler-Hardening-Guides/compiler-options-scraper
@@ -58,6 +58,6 @@ runs:
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
         if: ${{ !cancelled() && inputs.upload == 'true' }}
-        uses: github/codeql-action/upload-sarif@2d6b98c7cf7260afd6954ee7de478b21127b40f4 # ratchet:github/codeql-action/upload-sarif@v3.29.7
+        uses: github/codeql-action/upload-sarif@42947a340483f03ba47bb1a039b2c519aab3df85 # v3.37.8
         with:
             sarif_file: results.sarif
diff --git a/.github/workflows/github-actions-checker.yaml b/.github/workflows/github-actions-checker.yaml
index cdda745a4997..86940a4b4f18 100644
--- a/.github/workflows/github-actions-checker.yaml
+++ b/.github/workflows/github-actions-checker.yaml
@@ -37,7 +37,7 @@ jobs:
     runs-on: 'ubuntu-latest'
     name: 'ratchet'
     steps:
-      - uses: 'actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd' # ratchet:actions/checkout@v6.0.2
+      - uses: 'actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803' # v6.1.0
         with:
           persist-credentials: false
       - id: files
@@ -46,6 +46,6 @@ jobs:
             echo "${FILES}"
             echo "files=${FILES}" >> $GITHUB_OUTPUT
 
-      - uses: 'docker://ghcr.io/sethvargo/ratchet:latest@sha256:527e78e6d29a9ac306e843cf766afe0604a0b35633f16913d85dd522218e8ca1' # ratchet:docker://ghcr.io/sethvargo/ratchet:latest
+      - uses: 'docker://ghcr.io/sethvargo/ratchet:latest@sha256:ba6a286f8a53899714d17f89f45134678577431ca483b8000b5dba9267eee36c' # ratchet:docker://ghcr.io/sethvargo/ratchet:latest
         with:
           args: 'check ${{ steps.files.outputs.files }}'
diff --git a/.github/workflows/license-scanner.yaml b/.github/workflows/license-scanner.yaml
index cea89b633979..3d97f8ae46f1 100644
--- a/.github/workflows/license-scanner.yaml
+++ b/.github/workflows/license-scanner.yaml
@@ -35,11 +35,11 @@ jobs:
   run-scan:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
             fetch-depth: '0'
             persist-credentials: false
-      - uses: erlef/setup-beam@e6d7c94229049569db56a7ad5a540c051a010af9 # ratchet:erlef/setup-beam@v1.20.4
+      - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1
         with:
             otp-version: '27'
 
diff --git a/.github/workflows/main.yaml b/.github/workflows/main.yaml
index d158fbf4a270..88924df4df8c 100644
--- a/.github/workflows/main.yaml
+++ b/.github/workflows/main.yaml
@@ -316,11 +316,11 @@ jobs:
       security-events: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - name: Run zizmor
-        uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # ratchet:zizmorcore/zizmor-action@v0.5.2
+        uses: zizmorcore/zizmor-action@3dc1ecc9bcb9e94e9b2c709687979e1298497054 # v0.6.2
 
   # This job checks that the most important jobs are successful.
   # the use of conditionals, e.g., `if:` at the job level makes
diff --git a/.github/workflows/openvex-sync.yml b/.github/workflows/openvex-sync.yml
index 6cc27e64682f..8df711575d8d 100644
--- a/.github/workflows/openvex-sync.yml
+++ b/.github/workflows/openvex-sync.yml
@@ -39,12 +39,12 @@ jobs:
       pull-requests: write  # use inside the otp-compliance.es
     if: github.repository == 'erlang/otp'
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           ref: 'master' # '' = default branch
           persist-credentials: false
 
-      - uses: erlef/setup-beam@e6d7c94229049569db56a7ad5a540c051a010af9 # ratchet:erlef/setup-beam@v1.20.4
+      - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1
         with:
           otp-version: '28'
 
@@ -52,7 +52,7 @@ jobs:
         with:
           vexctl-release: '0.3.0'
 
-      - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # ratchet:actions/create-github-app-token@v2.2.1
+      - uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
         id: app-token
         with:
           # required
diff --git a/.github/workflows/ossf-compiler-flags-scanner.yaml b/.github/workflows/ossf-compiler-flags-scanner.yaml
index 241a737f80da..f2dd0bfcf7f7 100644
--- a/.github/workflows/ossf-compiler-flags-scanner.yaml
+++ b/.github/workflows/ossf-compiler-flags-scanner.yaml
@@ -44,7 +44,7 @@ jobs:
       # Only need to read contents
       contents: read
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - name: Create initial pre-release tar
diff --git a/.github/workflows/osv-scanner-scheduled.yml b/.github/workflows/osv-scanner-scheduled.yml
index 3623c4528cde..2a6d1c0d35b9 100644
--- a/.github/workflows/osv-scanner-scheduled.yml
+++ b/.github/workflows/osv-scanner-scheduled.yml
@@ -41,7 +41,7 @@ jobs:
     outputs:
        versions: ${{ steps.get-versions.outputs.versions }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - id: get-versions
diff --git a/.github/workflows/pr-comment.yaml b/.github/workflows/pr-comment.yaml
index ca2ea31b4c84..c5fa9716e852 100644
--- a/.github/workflows/pr-comment.yaml
+++ b/.github/workflows/pr-comment.yaml
@@ -49,10 +49,10 @@ jobs:
     outputs:
       result: ${{ steps.pr-number.outputs.result }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
-      - uses: erlef/setup-beam@e6d7c94229049569db56a7ad5a540c051a010af9 # ratchet:erlef/setup-beam@v1.20.4
+      - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1
         with:
             otp-version: '27'
       - name: Fetch PR number
@@ -72,7 +72,7 @@ jobs:
       pull-requests: write
     if: github.event.action == 'requested' && needs.pr-number.outputs.result != ''
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       ## We create an initial comment with some useful help to the user
@@ -99,7 +99,7 @@ jobs:
           needs.pr-number.outputs.result != '' &&
           github.event.workflow_run.conclusion != 'skipped'
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - name: Download and Extract Artifacts
@@ -128,7 +128,7 @@ jobs:
            fi
 
       - name: Publish CT Test Results
-        uses: EnricoMi/publish-unit-test-result-action@27d65e188ec43221b20d26de30f4892fad91df2f # ratchet:EnricoMi/publish-unit-test-result-action@v2.22.0
+        uses: EnricoMi/publish-unit-test-result-action@d0a4676d0e0b938bc201470d88276b7c74c712b3 # v2.24.0
         if: steps.extract.outputs.HAS_TEST_ARTIFACTS == 'true'
         with:
           commit: ${{ github.event.workflow_run.head_sha }}
diff --git a/.github/workflows/renovate-vendored-deps.yaml b/.github/workflows/renovate-vendored-deps.yaml
index 9abf6bbac131..6fcf9cd7c29f 100644
--- a/.github/workflows/renovate-vendored-deps.yaml
+++ b/.github/workflows/renovate-vendored-deps.yaml
@@ -39,7 +39,7 @@ jobs:
       contains(github.event.pull_request.title, 'update dependency') &&
       github.actor == 'renovate-bot'
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         # zizmor: ignore[artipacked]
         # git push in renovate-vendored-deps.sh needs credentials
         with:
diff --git a/.github/workflows/reusable-build-flavours.yaml b/.github/workflows/reusable-build-flavours.yaml
index 752466411810..c71406ad965d 100644
--- a/.github/workflows/reusable-build-flavours.yaml
+++ b/.github/workflows/reusable-build-flavours.yaml
@@ -48,7 +48,7 @@ jobs:
         flavor: [jit, emu]
       fail-fast: false
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/reusable-build-ios.yaml b/.github/workflows/reusable-build-ios.yaml
index 5e320b04af4e..d9af731523d0 100644
--- a/.github/workflows/reusable-build-ios.yaml
+++ b/.github/workflows/reusable-build-ios.yaml
@@ -43,7 +43,7 @@ jobs:
       contents: read   # actions/checkout
       actions: write   # actions/upload-artifact
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/reusable-build-macos.yaml b/.github/workflows/reusable-build-macos.yaml
index 6b023c10fa75..0968c0aca7fd 100644
--- a/.github/workflows/reusable-build-macos.yaml
+++ b/.github/workflows/reusable-build-macos.yaml
@@ -43,7 +43,7 @@ jobs:
       WXWIDGETS_VERSION: 3.2.9
       MACOS_VERSION: 15
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
@@ -54,7 +54,7 @@ jobs:
 
       - name: Cache wxWidgets
         id: wxwidgets-cache
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # ratchet:actions/cache@v5.0.3
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           path: wxWidgets
           key: wxWidgets-${{ env.WXWIDGETS_VERSION }}-${{ runner.os }}-${{ hashFiles('.github/scripts/build-macos-wxwidgets.sh') }}-${{ env.MACOS_VERSION }}
diff --git a/.github/workflows/reusable-build-otp.yaml b/.github/workflows/reusable-build-otp.yaml
index b9d95f86b7ca..8d60f09f97be 100644
--- a/.github/workflows/reusable-build-otp.yaml
+++ b/.github/workflows/reusable-build-otp.yaml
@@ -43,7 +43,7 @@ jobs:
       fail-fast: false
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/reusable-build-windows.yaml b/.github/workflows/reusable-build-windows.yaml
index 37176045eb98..74220647309b 100644
--- a/.github/workflows/reusable-build-windows.yaml
+++ b/.github/workflows/reusable-build-windows.yaml
@@ -45,7 +45,7 @@ jobs:
       contents: read   # actions/cache (restore/save wxWidgets cache)
       actions:  write  # actions/download-artifact + actions/upload-artifact
     steps:
-      - uses: Vampire/setup-wsl@6a8db447be7ed35f2f499c02c6e60ff77ef11278 # ratchet:Vampire/setup-wsl@v6.0.0
+      - uses: Vampire/setup-wsl@887f39deb6c0976365e546926fe66f41b77d65ff # v6.1.0
         with:
           distribution: Ubuntu-18.04
 
@@ -70,7 +70,7 @@ jobs:
         run: echo "os=${ImageOS:-unknown}" >> "$GITHUB_OUTPUT"
 
       - name: Cache wxWidgets
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # ratchet:actions/cache@v5.0.3
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           path: wxWidgets
           key: wxWidgets-${{ env.WXWIDGETS_VERSION }}-${{ steps.image.outputs.os }}
diff --git a/.github/workflows/reusable-check-files.yaml b/.github/workflows/reusable-check-files.yaml
index 64b6cdebfdc2..6d0ddfb6066c 100644
--- a/.github/workflows/reusable-check-files.yaml
+++ b/.github/workflows/reusable-check-files.yaml
@@ -55,7 +55,7 @@ jobs:
     permissions:
       contents: read   # actions/checkout (fetch-depth: 0) + git diff (whitespace + BEAM detection)
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 0
           persist-credentials: false
diff --git a/.github/workflows/reusable-documentation.yaml b/.github/workflows/reusable-documentation.yaml
index a7155f787bb9..01fef346b253 100644
--- a/.github/workflows/reusable-documentation.yaml
+++ b/.github/workflows/reusable-documentation.yaml
@@ -50,7 +50,7 @@ jobs:
       contents: read   # actions/checkout + ./.github/actions/build-base-image
       actions:  write  # actions/upload-artifact
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/reusable-freebsd.yaml b/.github/workflows/reusable-freebsd.yaml
index 171cbe4118e0..5ef99f694e70 100644
--- a/.github/workflows/reusable-freebsd.yaml
+++ b/.github/workflows/reusable-freebsd.yaml
@@ -44,7 +44,7 @@ jobs:
         with:
           name: otp_prebuilt
       - name: Build on FreeBSD
-        uses: vmactions/freebsd-vm@c9f815bc7aa0d34c9fdd0619b034a32d6ca7b57e # v1.4.2
+        uses: vmactions/freebsd-vm@d0518f912576ae759075aa00fb9fe27037940271 # v1.5.4
         with:
             usesh: true
             copyback: false
diff --git a/.github/workflows/reusable-openbsd.yaml b/.github/workflows/reusable-openbsd.yaml
index 84f9f69ebafe..13170e45b7dd 100644
--- a/.github/workflows/reusable-openbsd.yaml
+++ b/.github/workflows/reusable-openbsd.yaml
@@ -44,7 +44,7 @@ jobs:
         with:
           name: otp_prebuilt
       - name: Build on OpenBSD
-        uses: vmactions/openbsd-vm@d6c29ce1b4d9620b1f472e0022c106703387358f # v1.3.5
+        uses: vmactions/openbsd-vm@e6c68b637a12e83519688d115d57d5b0b53923cd # v1.4.6
         with:
             usesh: true
             copyback: false
diff --git a/.github/workflows/reusable-pack.yaml b/.github/workflows/reusable-pack.yaml
index 3d06434c7a6a..b8efbdb181c7 100644
--- a/.github/workflows/reusable-pack.yaml
+++ b/.github/workflows/reusable-pack.yaml
@@ -61,7 +61,7 @@ jobs:
       build-c-code: ${{ steps.build-c-code.outputs.value }}
       all:          ${{ steps.apps.outputs.all }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
@@ -82,7 +82,7 @@ jobs:
           echo "all=${ALL_APPS}" >> $GITHUB_OUTPUT
 
       - name: Check which applications have changed
-        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # ratchet:dorny/paths-filter@v3.0.2
+        uses: dorny/paths-filter@0e4a8c6effa4802afeda77dc8d303f8176d7dfad # v3.0.4
         id: app-changes
         with:
           filters: .github/scripts/path-filters.yaml
@@ -102,7 +102,7 @@ jobs:
           fi
 
       - name: Check if there are any C-code changes, if not then limit CI run
-        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # ratchet:dorny/paths-filter@v3.0.2
+        uses: dorny/paths-filter@0e4a8c6effa4802afeda77dc8d303f8176d7dfad # v3.0.4
         id: c-code-changes
         with:
           filters: .github/scripts/c-code-path-filters.yaml
@@ -121,7 +121,7 @@ jobs:
           fi
 
       - name: Cache pre-built src
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # ratchet:actions/cache@v5.0.3
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
             path: otp_src.tar.gz
             key: prebuilt-src-${{ github.ref_name }}-${{ github.sha }}
@@ -129,7 +129,7 @@ jobs:
                 prebuilt-src-${{ github.base_ref }}-${{ github.event.pull_request.base.sha }}
 
       - name: Cache pre-built binaries
-        uses: actions/cache@cdf6c1fa76f9f475f3d7449005a359c84ca0f306 # ratchet:actions/cache@v5.0.3
+        uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
             path: otp_cache.tar.gz
             key: prebuilt-cache-64-bit-${{ github.ref_name }}-${{ github.sha }}
@@ -146,7 +146,7 @@ jobs:
           path: otp_archive.tar.gz
 
       - name: Check how we can use the pre-built cache
-        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # ratchet:dorny/paths-filter@v3.0.2
+        uses: dorny/paths-filter@0e4a8c6effa4802afeda77dc8d303f8176d7dfad # v3.0.4
         id: cache
         with:
           filters: |
diff --git a/.github/workflows/reusable-release.yaml b/.github/workflows/reusable-release.yaml
index eaabef759d54..f6b1a5dfbc8d 100644
--- a/.github/workflows/reusable-release.yaml
+++ b/.github/workflows/reusable-release.yaml
@@ -54,7 +54,7 @@ jobs:
       actions:      write   # actions/download-artifact (otp_prebuilt, otp_doc_html, otp_doc_man, ort-results-*)
                             # actions/upload-artifact (Attestations)
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/reusable-sbom.yaml b/.github/workflows/reusable-sbom.yaml
index 8885a2c6a7fd..d6c313798e84 100644
--- a/.github/workflows/reusable-sbom.yaml
+++ b/.github/workflows/reusable-sbom.yaml
@@ -63,7 +63,7 @@ jobs:
       - name: Use HTTPS instead of SSH for Git cloning
         run: git config --global url.https://github.com/.insteadOf ssh://git@github.com/
 
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
@@ -72,7 +72,7 @@ jobs:
           BASE_BRANCH: ${{ inputs.base_branch }}
 
       - name: Fetch Default ORT Config
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           repository: oss-review-toolkit/ort-config
           ref: "d2978deb230beae095bb6cfec074b94f1a74fd34"
@@ -95,7 +95,7 @@ jobs:
         run: echo "ort_version=${{ env.ORT_VERSION }}" >> $GITHUB_OUTPUT
 
       - name: Run OSS Review Toolkit (analyzer)
-        uses: oss-review-toolkit/ort-ci-github-action@1805edcf1f4f55f35ae6e4d2d9795ccfb29b6021 # ratchet:oss-review-toolkit/ort-ci-github-action@v1.1.0
+        uses: oss-review-toolkit/ort-ci-github-action@086d928d24ef1653dc0777296b312fda5faaaf52 # v1.2.0
         with:
             image: ghcr.io/oss-review-toolkit/ort-minimal:${{ env.ORT_VERSION }}
             run: >
@@ -108,7 +108,7 @@ jobs:
         run: ln -s analyzer-result.json $HOME/.ort/ort-results/current-result.json
 
       - name: Restore ORT Scanner cache
-        uses: actions/cache/restore@b7e8d49f17405cc70c1c120101943203c98d3a4b # ratchet:actions/cache/restore@v4
+        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         id: ort-cache
         if: ${{ inputs.full_build_and_check == 'false' }}
         with:
@@ -146,7 +146,7 @@ jobs:
 
       - name: Run OSS Review Toolkit (scanner)
         if: hashFiles(env.SCAN_RESULT_CACHE_PATH) == ''
-        uses: oss-review-toolkit/ort-ci-github-action@1805edcf1f4f55f35ae6e4d2d9795ccfb29b6021 # ratchet:oss-review-toolkit/ort-ci-github-action@v1.1.0
+        uses: oss-review-toolkit/ort-ci-github-action@086d928d24ef1653dc0777296b312fda5faaaf52 # v1.2.0
         with:
             image: ghcr.io/oss-review-toolkit/ort-minimal:${{ env.ORT_VERSION }}
             run: >
@@ -175,7 +175,7 @@ jobs:
           ln -f -s scan-result.reuse.json $HOME/.ort/ort-results/current-result.json
 
       - name: Run OSS Review Toolkit (reporter)
-        uses: oss-review-toolkit/ort-ci-github-action@1805edcf1f4f55f35ae6e4d2d9795ccfb29b6021 # ratchet:oss-review-toolkit/ort-ci-github-action@v1.1.0
+        uses: oss-review-toolkit/ort-ci-github-action@086d928d24ef1653dc0777296b312fda5faaaf52 # v1.2.0
         with:
             image: ghcr.io/oss-review-toolkit/ort-minimal:${{ env.ORT_VERSION }}
             run: >
@@ -185,7 +185,7 @@ jobs:
             sw-version: ${{ env.OTP_SBOM_VERSION }}
 
       - name: Save ORT Scanner cache
-        uses: actions/cache/save@b7e8d49f17405cc70c1c120101943203c98d3a4b # ratchet:actions/cache/save@v4
+        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
         if: steps.ort-cache.outputs.cache-hit != 'true'
         with:
             path: ${{ env.SCAN_RESULT_CACHE_PATH }}
@@ -212,7 +212,7 @@ jobs:
           path: /home/runner/.ort/ort-results/bom.spdx.json
 
       - name: Run OSS Review Toolkit (upload)
-        uses: oss-review-toolkit/ort-ci-github-action@1805edcf1f4f55f35ae6e4d2d9795ccfb29b6021 # ratchet:oss-review-toolkit/ort-ci-github-action@v1.1.0
+        uses: oss-review-toolkit/ort-ci-github-action@086d928d24ef1653dc0777296b312fda5faaaf52 # v1.2.0
         with:
             image: ghcr.io/oss-review-toolkit/ort-minimal:${{ env.ORT_VERSION }}
             run: >
@@ -224,7 +224,7 @@ jobs:
         run: ln -f -s scan-result.reuse.json $HOME/.ort/ort-results/current-result.json
 
       - name: Run OSS Review Toolkit (evaluator)
-        uses: oss-review-toolkit/ort-ci-github-action@1805edcf1f4f55f35ae6e4d2d9795ccfb29b6021 # ratchet:oss-review-toolkit/ort-ci-github-action@v1.1.0
+        uses: oss-review-toolkit/ort-ci-github-action@086d928d24ef1653dc0777296b312fda5faaaf52 # v1.2.0
         with:
             image: ghcr.io/oss-review-toolkit/ort-minimal:${{ env.ORT_VERSION }}
             run: >
@@ -244,7 +244,7 @@ jobs:
       id-token: write   # dependency submission OIDC
       actions: read     # actions/download-artifact
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/reusable-solaris.yaml b/.github/workflows/reusable-solaris.yaml
index 4cd577a9370c..03b053fd9f49 100644
--- a/.github/workflows/reusable-solaris.yaml
+++ b/.github/workflows/reusable-solaris.yaml
@@ -44,7 +44,7 @@ jobs:
         with:
           name: otp_prebuilt
       - name: Build on Solaris
-        uses: vmactions/solaris-vm@a5f280f06289e0d16f882b06a22c922517baa857 # v1.3.0
+        uses: vmactions/solaris-vm@315163f088b66e55bbcc45928bd224d4973b2312 # v1.3.8
         with:
             usesh: true
             copyback: false
diff --git a/.github/workflows/reusable-static-analysis.yaml b/.github/workflows/reusable-static-analysis.yaml
index 44882e226863..8fed28d38544 100644
--- a/.github/workflows/reusable-static-analysis.yaml
+++ b/.github/workflows/reusable-static-analysis.yaml
@@ -39,7 +39,7 @@ jobs:
       contents: read
       security-events: write   # needed for SARIF upload
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/reusable-system-test.yaml b/.github/workflows/reusable-system-test.yaml
index a42ae3eb791f..e8569b8329f1 100644
--- a/.github/workflows/reusable-system-test.yaml
+++ b/.github/workflows/reusable-system-test.yaml
@@ -43,7 +43,7 @@ jobs:
       contents: read   # actions/checkout + ./.github/actions/build-base-image
       actions: write   # actions/download-artifact + actions/upload-artifact
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
diff --git a/.github/workflows/reusable-test.yaml b/.github/workflows/reusable-test.yaml
index 94927e5de6f9..423f6726d4fd 100644
--- a/.github/workflows/reusable-test.yaml
+++ b/.github/workflows/reusable-test.yaml
@@ -52,7 +52,7 @@ jobs:
         # type: ["os_mon","sasl"]
       fail-fast: false
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       - uses: ./.github/actions/build-base-image
diff --git a/.github/workflows/reusable-vendor-vulnerability-scanner.yml b/.github/workflows/reusable-vendor-vulnerability-scanner.yml
index fda6ebfa4036..124faac80e09 100644
--- a/.github/workflows/reusable-vendor-vulnerability-scanner.yml
+++ b/.github/workflows/reusable-vendor-vulnerability-scanner.yml
@@ -104,7 +104,7 @@ jobs:
     outputs:
       vendor-files: ${{ steps.vendor-files.outputs.MODIFIED_FILES != '0' }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           fetch-depth: 0
           persist-credentials: false
@@ -131,12 +131,12 @@ jobs:
       actions: read
     if: ${{ !cancelled() && (needs.modified-vendor-files.result == 'success' || needs.modified-vendor-files.result == 'skipped') }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           ref: ${{ inputs.checkout && inputs.version || ''}} # '' = default branch
           persist-credentials: false
 
-      - uses: erlef/setup-beam@e6d7c94229049569db56a7ad5a540c051a010af9 # ratchet:erlef/setup-beam@v1.20.4
+      - uses: erlef/setup-beam@54075bcc5e249e4758d363f27d099f55d843f124 # v1.24.1
         with:
           otp-version: '28'
 
@@ -149,7 +149,7 @@ jobs:
       # so we need to use the condition below for PRs based on a fork
       - name: "Generate GitHub App Token (if secrets exist)"
         if: ${{ env.IS_NOT_FORKED_PR == 'true' }}
-        uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # ratchet:actions/create-github-app-token@v2.2.1
+        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
         id: app-token
         with:
           app-id: ${{ secrets.ERLANG_VENDOR_SCANNER_APP_ID }}
diff --git a/.github/workflows/scorecard.yaml b/.github/workflows/scorecard.yaml
index 80714d2a8276..64a4b166b25d 100644
--- a/.github/workflows/scorecard.yaml
+++ b/.github/workflows/scorecard.yaml
@@ -45,12 +45,12 @@ jobs:
       actions: read
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
 
       - name: Run analysis
-        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # ratchet:ossf/scorecard-action@v2.4.3
+        uses: ossf/scorecard-action@2d1146689b8cda280b9bc96326124645441f03bc # v2.4.4
         with:
           results_file: results.sarif
           results_format: sarif
diff --git a/.github/workflows/sigstore-updater.yml b/.github/workflows/sigstore-updater.yml
index 2408b5834196..6550f20f79e1 100644
--- a/.github/workflows/sigstore-updater.yml
+++ b/.github/workflows/sigstore-updater.yml
@@ -49,7 +49,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
             persist-credentials: false
       - name: Download release artifacts
@@ -97,7 +97,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout PR branch
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           ref: "${{ github.head_ref }}"
           fetch-depth: 0
@@ -140,7 +140,7 @@ jobs:
         uses: actions/attest@59d89421af93a897026c735860bf21b6eb4f7b26 # v4.10
         with:
           subject-path: 'vex/*.openvex.json'
-      - uses: actions/create-github-app-token@29824e69f54612133e76f7eaac726eef6c875baf # v2.2.1
+      - uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
         if: steps.changed.outputs.found == 'true'
         id: app-token
         with:
diff --git a/.github/workflows/sync-github-releases.yaml b/.github/workflows/sync-github-releases.yaml
index 9594724c7649..70ae074b9b63 100644
--- a/.github/workflows/sync-github-releases.yaml
+++ b/.github/workflows/sync-github-releases.yaml
@@ -43,7 +43,7 @@ jobs:
         contents: write
         actions: write
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false
       ## We need to login to the package registry in order to pull
diff --git a/.github/workflows/update-base.yaml b/.github/workflows/update-base.yaml
index 8e5ed50d0524..14c608ccca62 100644
--- a/.github/workflows/update-base.yaml
+++ b/.github/workflows/update-base.yaml
@@ -49,7 +49,7 @@ jobs:
       fail-fast: false
 
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           ref: ${{ matrix.branch }}
           persist-credentials: false
diff --git a/.github/workflows/upload-windows-zip.yaml b/.github/workflows/upload-windows-zip.yaml
index 9a686791611f..836bcc95142d 100644
--- a/.github/workflows/upload-windows-zip.yaml
+++ b/.github/workflows/upload-windows-zip.yaml
@@ -43,7 +43,7 @@ jobs:
     env:
       BASENAME: otp_${{ inputs.target }}_${{ inputs.version }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # ratchet:actions/checkout@v6.0.2
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           persist-credentials: false