diff --git a/.github/workflows/docker-build.yml b/.github/workflows/docker-build.yml
index 4783ef38..8444ac4e 100644
--- a/.github/workflows/docker-build.yml
+++ b/.github/workflows/docker-build.yml
@@ -21,16 +21,16 @@ jobs:
       matrix:
         platform: [linux/amd64, linux/arm64]
     steps:
-      - uses: actions/checkout@v7
-      - uses: docker/setup-qemu-action@v4
-      - uses: docker/setup-buildx-action@v4
-      - uses: docker/login-action@v4
+      - uses: actions/checkout@v7.0.1
+      - uses: docker/setup-qemu-action@v4.3.0
+      - uses: docker/setup-buildx-action@v4.3.0
+      - uses: docker/login-action@v4.6.0
         with:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
       - id: meta
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@v6.2.0
         with:
           images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
           tags: |
@@ -39,7 +39,7 @@ jobs:
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
             type=raw,value=latest,enable={{is_default_branch}}
-      - uses: docker/build-push-action@v7
+      - uses: docker/build-push-action@v7.3.0
         with:
           context: .
           platforms: ${{ matrix.platform }}
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 2204a1ef..8eae2558 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -20,10 +20,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Set up Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@v7.0.0
         with:
           python-version: '3.14.7'
 
@@ -47,7 +47,7 @@ jobs:
           echo "Webapp integrated at site/simulator/"
 
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v5
+        uses: actions/upload-pages-artifact@v5.0.0
         with:
           path: ./site
 
@@ -61,4 +61,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v5
+        uses: actions/deploy-pages@v5.0.1
diff --git a/.github/workflows/install_dependencies/action.yml b/.github/workflows/install_dependencies/action.yml
index 76959703..0afbe9ba 100644
--- a/.github/workflows/install_dependencies/action.yml
+++ b/.github/workflows/install_dependencies/action.yml
@@ -14,14 +14,14 @@ runs:
   using: "composite"
   steps:
     - name: Check out code from GitHub
-      uses: actions/checkout@v7
+      uses: actions/checkout@v7.0.1
       with:
         repository: ${{ github.repository }}
         ref: ${{ github.sha }}
         persist-credentials: false
         fetch-depth: 0
     - name: Check out code from GitHub
-      uses: actions/checkout@v7
+      uses: actions/checkout@v7.0.1
       with:
         repository: home-assistant/core
         path: core
diff --git a/.github/workflows/main-to-master-sync.yml b/.github/workflows/main-to-master-sync.yml
index a2756894..6b16b8e5 100644
--- a/.github/workflows/main-to-master-sync.yml
+++ b/.github/workflows/main-to-master-sync.yml
@@ -11,7 +11,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v7
+      uses: actions/checkout@v7.0.1
       with:
         ref: main
         fetch-depth: 0
diff --git a/.github/workflows/markdown-code-runner.yml b/.github/workflows/markdown-code-runner.yml
index 279a7f8a..9614ee7d 100644
--- a/.github/workflows/markdown-code-runner.yml
+++ b/.github/workflows/markdown-code-runner.yml
@@ -11,14 +11,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
         with:
           repository: ${{ github.event.pull_request.head.repo.full_name || github.repository }}
           ref: ${{ github.head_ref || github.ref }}
           fetch-depth: 0
 
       - name: Set up Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@v7.0.0
         with:
           python-version: "3.14.7"
 
diff --git a/.github/workflows/pre-commit.yaml b/.github/workflows/pre-commit.yaml
index e67ef449..16a9cc58 100644
--- a/.github/workflows/pre-commit.yaml
+++ b/.github/workflows/pre-commit.yaml
@@ -9,6 +9,6 @@ jobs:
   pre-commit:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v7
-    - uses: actions/setup-python@v7
+    - uses: actions/checkout@v7.0.1
+    - uses: actions/setup-python@v7.0.0
     - uses: pre-commit/action@v3.0.1
diff --git a/.github/workflows/pytest.yaml b/.github/workflows/pytest.yaml
index 8b2614f0..b34a7262 100644
--- a/.github/workflows/pytest.yaml
+++ b/.github/workflows/pytest.yaml
@@ -52,7 +52,7 @@ jobs:
             python-version: "3.14.2"
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Install Home Assistant
         uses: ./.github/workflows/install_dependencies
diff --git a/.github/workflows/release-drafter.yml b/.github/workflows/release-drafter.yml
index 973577d1..97912b67 100644
--- a/.github/workflows/release-drafter.yml
+++ b/.github/workflows/release-drafter.yml
@@ -17,7 +17,7 @@ jobs:
       pull-requests: write
     runs-on: ubuntu-latest
     steps:
-      - uses: release-drafter/release-drafter@v7
+      - uses: release-drafter/release-drafter@v7.7.0
         with:
           dry-run: ${{ github.event_name == 'pull_request' }}
         env:
diff --git a/.github/workflows/toc.yaml b/.github/workflows/toc.yaml
index a2665757..cde1b6d4 100644
--- a/.github/workflows/toc.yaml
+++ b/.github/workflows/toc.yaml
@@ -7,6 +7,6 @@ jobs:
     name: TOC Generator
     runs-on: ubuntu-latest
     steps:
-      - uses: technote-space/toc-generator@v4
+      - uses: technote-space/toc-generator@v4.3.1
         with:
           TOC_TITLE: ""
diff --git a/.github/workflows/update-test-matrix.yaml b/.github/workflows/update-test-matrix.yaml
index e67ae227..1556e3a0 100644
--- a/.github/workflows/update-test-matrix.yaml
+++ b/.github/workflows/update-test-matrix.yaml
@@ -16,10 +16,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Set up Python
-        uses: actions/setup-python@v7
+        uses: actions/setup-python@v7.0.0
         with:
           python-version: "3.14.7"
 
@@ -39,7 +39,7 @@ jobs:
 
       - name: Create Pull Request
         if: steps.changes.outputs.changed == 'true'
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@v8.1.1
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           commit-message: "ci: update HA Core test matrix versions"
diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 83ce8ad9..b7c1a44b 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -11,7 +11,7 @@ jobs:
   validate_hacs:
     runs-on: "ubuntu-latest"
     steps:
-      - uses: "actions/checkout@v7"
+      - uses: "actions/checkout@v7.0.1"
       - name: HACS validation
         uses: "hacs/action@main"
         with: