diff --git a/.github/workflows/conformance-tests-bigtable-proxy.yaml b/.github/workflows/conformance-tests-bigtable-proxy.yaml
index 6560a5f0e21..c2018342519 100644
--- a/.github/workflows/conformance-tests-bigtable-proxy.yaml
+++ b/.github/workflows/conformance-tests-bigtable-proxy.yaml
@@ -26,27 +26,32 @@ on:
       - '.github/workflows/conformance-tests-bigtable-proxy.yaml'
   workflow_dispatch:
 name: Run Bigtable Conformance Tests With Proxy
+permissions:
+  contents: read
 jobs:
   conformance:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.1'
           extensions: grpc
 
       - name: Checkout Bigtable conformance tests
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           repository: googleapis/cloud-bigtable-clients-test
           ref: v0.0.3
           path: cloud-bigtable-clients-test
+          persist-credentials: false
 
-      - uses: actions/setup-go@v7
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
         with:
           go-version: '>=1.20.2'
 
diff --git a/.github/workflows/conformance-tests-gax-showcase.yaml b/.github/workflows/conformance-tests-gax-showcase.yaml
index 864d3748350..fcca0736bd2 100644
--- a/.github/workflows/conformance-tests-gax-showcase.yaml
+++ b/.github/workflows/conformance-tests-gax-showcase.yaml
@@ -8,18 +8,20 @@ permissions:
   contents: read
 jobs:
   gapic-showcase:
+    name: GAPIC Showcase Conformance Tests
     runs-on: ubuntu-latest
     env:
       GAPIC_SHOWCASE_VERSION: 0.42.0
       OS: linux
       ARCH: amd64
-    name: GAPIC Showcase Conformance Tests
     steps:
     - name: Checkout code
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      with:
+        persist-credentials: false
 
     - name: Setup PHP
-      uses: shivammathur/setup-php@v2
+      uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
       with:
         php-version: '8.2'
         extensions: grpc-1.83.0
diff --git a/.github/workflows/conformance-tests-storage-emulator.yaml b/.github/workflows/conformance-tests-storage-emulator.yaml
index 7a2c50bbeb5..47930470240 100644
--- a/.github/workflows/conformance-tests-storage-emulator.yaml
+++ b/.github/workflows/conformance-tests-storage-emulator.yaml
@@ -10,6 +10,8 @@ on:
       - 'Storage/**'
       - '.github/workflows/conformance-tests-storage-emulator.yaml'
 name: Run Storage Retry Conformance Tests With Emulator
+permissions:
+  contents: read
 jobs:
   test:
     runs-on: 'ubuntu-24.04'
@@ -22,10 +24,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.1'
 
diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml
index 98c2c9a82ff..515c58c7190 100644
--- a/.github/workflows/docs.yaml
+++ b/.github/workflows/docs.yaml
@@ -5,6 +5,9 @@ on:
   pull_request:
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   docfx:
     name: "Run DocFX tests"
@@ -12,26 +15,30 @@ jobs:
     env:
       PHPDOC_ENV: prod
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      with:
+        persist-credentials: false
     - name: Setup Python
-      uses: actions/setup-python@v7
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7
       with:
         python-version: '3.14'
     - run: pip install --require-hashes -r .kokoro/docs/docker/requirements.txt
     - name: Setup PHP
-      uses: shivammathur/setup-php@verbose
+      uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
       with:
         php-version: "8.2"
     - name: Extract phpDocumentor
       id: extract
-      uses: shrink/actions-docker-extract@v4
+      uses: shrink/actions-docker-extract@f1ef61065b78731fe3310b4e84e511f6a927a77e # v4
       with:
         image: "phpdoc/phpdoc:3.5.3"
         path: "/opt/phpdoc/."
     - name: Symlink phpDocumentor
-      run: ln -s $(pwd)/${{ steps.extract.outputs.destination }}/bin/phpdoc /usr/local/bin/phpdoc
+      run: ln -s $(pwd)/${STEPS_EXTRACT_OUTPUTS_DESTINATION}/bin/phpdoc /usr/local/bin/phpdoc
+      env:
+        STEPS_EXTRACT_OUTPUTS_DESTINATION: ${{ steps.extract.outputs.destination }}
     - name: Install Dependencies
-      uses: nick-invision/retry@v4
+      uses: nick-invision/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4
       with:
         timeout_minutes: 10
         max_attempts: 3
diff --git a/.github/workflows/emulator-system-tests-bigtable.yaml b/.github/workflows/emulator-system-tests-bigtable.yaml
index e628ceff9d4..e18bdd0734d 100644
--- a/.github/workflows/emulator-system-tests-bigtable.yaml
+++ b/.github/workflows/emulator-system-tests-bigtable.yaml
@@ -19,12 +19,14 @@ jobs:
     name: Bigtable
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - run: ./.github/emulator/start-emulator.sh bigtable 522.0.0-emulators
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.1'
           tools: pecl
diff --git a/.github/workflows/emulator-system-tests-datastore.yaml b/.github/workflows/emulator-system-tests-datastore.yaml
index 039ffe245ed..97515c527ea 100644
--- a/.github/workflows/emulator-system-tests-datastore.yaml
+++ b/.github/workflows/emulator-system-tests-datastore.yaml
@@ -19,12 +19,14 @@ jobs:
     name: Datastore
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - run: ./.github/emulator/start-emulator.sh datastore 522.0.0-emulators
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.1'
           tools: pecl
diff --git a/.github/workflows/emulator-system-tests-firestore.yaml b/.github/workflows/emulator-system-tests-firestore.yaml
index 9815b4fbf1e..06af2125dec 100644
--- a/.github/workflows/emulator-system-tests-firestore.yaml
+++ b/.github/workflows/emulator-system-tests-firestore.yaml
@@ -19,12 +19,14 @@ jobs:
     name: Firestore
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - run: ./.github/emulator/start-emulator.sh firestore 522.0.0-emulators
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.1'
           tools: pecl
diff --git a/.github/workflows/emulator-system-tests-pubsub.yaml b/.github/workflows/emulator-system-tests-pubsub.yaml
index ec56723d86e..372baa554c5 100644
--- a/.github/workflows/emulator-system-tests-pubsub.yaml
+++ b/.github/workflows/emulator-system-tests-pubsub.yaml
@@ -19,12 +19,14 @@ jobs:
     name: PubSub
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - run: ./.github/emulator/start-emulator.sh pubsub
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.1'
           tools: pecl
diff --git a/.github/workflows/emulator-system-tests-spanner.yaml b/.github/workflows/emulator-system-tests-spanner.yaml
index 62dd6dfe1b8..464a698cba1 100644
--- a/.github/workflows/emulator-system-tests-spanner.yaml
+++ b/.github/workflows/emulator-system-tests-spanner.yaml
@@ -25,10 +25,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
 
       - name: Create Spanner instance
-        uses: google-github-actions/setup-gcloud@v3
+        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3
         with:
           version: '516.0.0'
       - run: gcloud info
@@ -39,7 +41,7 @@ jobs:
       - run: gcloud spanner instances create google-cloud-php-system-tests --config=emulator-config --description="Test Instance" --nodes=1
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: '8.4'
           ini-values: grpc.enable_fork_support=1
diff --git a/.github/workflows/lint.yaml b/.github/workflows/lint.yaml
index 14b493339aa..0bf35cdb947 100644
--- a/.github/workflows/lint.yaml
+++ b/.github/workflows/lint.yaml
@@ -12,9 +12,11 @@ jobs:
     runs-on: ubuntu-latest
     name: PHP Style Check
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      with:
+        persist-credentials: false
     - name: Setup PHP
-      uses: shivammathur/setup-php@v2
+      uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
       with:
         php-version: '8.1'
     - name: Install Dependencies
@@ -24,7 +26,7 @@ jobs:
 
   style_csfixer:
     name: PHP CS Fixer
-    uses: GoogleCloudPlatform/php-tools/.github/workflows/code-standards.yml@main
+    uses: GoogleCloudPlatform/php-tools/.github/workflows/code-standards.yml@8d707553d2c90c3b614941950814dcc10c19ce47 # main
     with:
       config: GoogleCloudPlatform/php-tools/.php-cs-fixer.default.php@main
       exclude-patterns: |
@@ -52,9 +54,11 @@ jobs:
     runs-on: ubuntu-latest
     name: PHPStan Static Analysis
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      with:
+        persist-credentials: false
     - name: Install PHP
-      uses: shivammathur/setup-php@v2
+      uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
       with:
         php-version: '8.2'
     - name: "Install dependencies"
diff --git a/.github/workflows/major-version-approval.yaml b/.github/workflows/major-version-approval.yaml
index b2e0a6993bd..8d1675842f1 100644
--- a/.github/workflows/major-version-approval.yaml
+++ b/.github/workflows/major-version-approval.yaml
@@ -19,7 +19,7 @@ jobs:
     if: github.event.pull_request.user.login == 'release-please[bot]' && contains(github.event.pull_request.body, 'MAJOR_VERSION_ALLOWED=')
     steps:
       - name: Run Approval Check
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9
         env:
           GH_TOKEN: ${{ secrets.SPLIT_TOKEN }}
         with:
diff --git a/.github/workflows/owlbot-checks.yaml b/.github/workflows/owlbot-checks.yaml
index b69f3a68eca..a435e460969 100644
--- a/.github/workflows/owlbot-checks.yaml
+++ b/.github/workflows/owlbot-checks.yaml
@@ -3,6 +3,8 @@ on:
   pull_request:
     types: [opened, synchronize, reopened, edited]
     branches: ['main']
+permissions:
+  contents: read
 jobs:
   # Ensure that PRs labeled "feat" actually contain a new feature, PRs labeled
   # "bug" or "chore" do not.
@@ -12,11 +14,12 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event.pull_request.user.login == 'gcf-owl-bot[bot]'
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: "Install PHP"
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: "8.1"
       - name: "Install dependencies"
@@ -25,18 +28,23 @@ jobs:
         id: compatibility-checker
         continue-on-error: true
         # OwlBot PRs which are not labelled feat should not add new files or methods
+        env:
+          FROM_REF: ${{ github.head_ref || github.ref_name }}
         run: |
           ~/.composer/vendor/bin/roave-backward-compatibility-check \
-            --from=origin/${{ github.head_ref || github.ref_name }} \
+            --from=origin/${FROM_REF} \
             --to=origin/main
       - name: "Print the action item"
+        env:
+          STEPS_COMPATIBILITY_CHECKER_OUTCOME: ${{ steps.compatibility-checker.outcome }}
+          IS_STARTS_WITH_FEAT: ${{ startsWith(github.event.pull_request.title, 'feat') }}
         run: |
-          if [[ "${{ steps.compatibility-checker.outcome }}" == 'failure' ]]; then
-            if [[ "${{ startsWith(github.event.pull_request.title, 'feat') }}" == "false" ]]; then
+          if [[ "${STEPS_COMPATIBILITY_CHECKER_OUTCOME}" == 'failure' ]]; then
+            if [[ "${IS_STARTS_WITH_FEAT}" == "false" ]]; then
               echo "Action item: Change the conventional commit to use 'feat'"
               exit 1
             fi
-          elif [[ "${{ startsWith(github.event.pull_request.title, 'feat') }}" == "true" ]]; then
+          elif [[ "${IS_STARTS_WITH_FEAT}" == "true" ]]; then
             echo "Action item: No features found, do not use 'feat' for the conventional commit"
             exit 1
           fi
@@ -47,7 +55,9 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event.pull_request.user.login == 'gcf-owl-bot[bot]' && github.event.pull_request.draft == false
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
       - name: Ensure
         run: |
           directory_to_check="owl-bot-staging"
diff --git a/.github/workflows/release-checks.yaml b/.github/workflows/release-checks.yaml
index 336a93531f5..b1fbb6fceaa 100644
--- a/.github/workflows/release-checks.yaml
+++ b/.github/workflows/release-checks.yaml
@@ -12,19 +12,22 @@ jobs:
     runs-on: ubuntu-latest
     if: ${{ !contains(github.event.pull_request.body, 'BREAKING_CHANGE_REASON=') }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: "Install PHP"
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: "8.1"
       - name: "Rebase PR branch onto main branch"
         if: github.event.pull_request.user.login != 'release-please[bot]'
+        env:
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
         run: |
           git config user.name "Github Actions"
           git config user.email "actions@github.com"
-          git checkout ${{ github.event.pull_request.head.sha }}
+          git checkout "$HEAD_SHA"
           if ! git rebase origin/main; then
             echo "Failed to rebase PR branch onto main. There may be conflicts. Please resolve conflicts or rebase manually."
             exit 1
@@ -36,15 +39,17 @@ jobs:
         run: |
           ~/.composer/vendor/bin/roave-backward-compatibility-check --from=origin/main --format=github-actions
       - name: "Check for BC label"
+        env:
+          HAS_BC_LABEL: ${{ contains(github.event.pull_request.title, '!:') }}
         run: |
-          if [[ "true" == "${{ contains(github.event.pull_request.title, '!:') }}" ]]; then
+          if [[ "true" == "${HAS_BC_LABEL}" ]]; then
             echo "Breaking change label found in PR title"
             exit 1
           fi
       - name: Get Latest Release
         if: github.event.pull_request.user.login == 'release-please[bot]'
         id: latest-release
-        uses: pozetroninc/github-action-get-latest-release@master
+        uses: pozetroninc/github-action-get-latest-release@5ac6001ed175b443484c81ab32a20e12132be99c # master
         with:
           repository: ${{ github.repository }}
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -54,8 +59,10 @@ jobs:
         continue-on-error: true
         run: |
           ~/.composer/vendor/bin/roave-backward-compatibility-check \
-              --from=${{ steps.latest-release.outputs.release }} \
+              --from=${STEPS_LATEST_RELEASE_OUTPUTS_RELEASE} \
               --to=origin/main --format=github-actions
+        env:
+          STEPS_LATEST_RELEASE_OUTPUTS_RELEASE: ${{ steps.latest-release.outputs.release }}
 
   # Ensure the release PR does not contain an unexpected (e.g. 2.0.0) major version release
   # Add "MAJOR_VERSION_ALLOWED=component1,component2" to the PR description to allow major version
@@ -65,11 +72,12 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event.pull_request.user.login == 'release-please[bot]'
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Parse allowed major versions
-        uses: actions-ecosystem/action-regex-match@v2
+        uses: actions-ecosystem/action-regex-match@9e6c4fb3d5e898f505be7a1fb6e7b0a278f6665b # v2
         id: allowed-major-versions
         with:
           text: ${{ github.event.pull_request.body }}
@@ -78,7 +86,7 @@ jobs:
       - name: "Check for unexpected major version"
         run: |
           # parse allowed major versions into an array
-          IFS=', ' read -r -a ALLOWED_MAJOR_VERSIONS <<< "${{ steps.allowed-major-versions.outputs.group1 }}"
+          IFS=', ' read -r -a ALLOWED_MAJOR_VERSIONS <<< "${STEPS_ALLOWED_MAJOR_VERSIONS_OUTPUTS_GROUP1}"
           # get all changed components
           COMPONENTS=$(git diff origin/main --name-only | grep VERSION | xargs dirname)
           FAIL=""
@@ -102,10 +110,12 @@ jobs:
             echo "major version releases for those components"
             exit 1
           fi
+        env:
+          STEPS_ALLOWED_MAJOR_VERSIONS_OUTPUTS_GROUP1: ${{ steps.allowed-major-versions.outputs.group1 }}
 
   next-release-label-check:
     name: Check for "next release" label
-    uses: GoogleCloudPlatform/php-tools/.github/workflows/release-checks.yml@main
+    uses: GoogleCloudPlatform/php-tools/.github/workflows/release-checks.yml@8d707553d2c90c3b614941950814dcc10c19ce47 # main
     if: github.event.pull_request.user.login == 'release-please[bot]'
     with:
       next-release-label-check: true
@@ -116,11 +126,12 @@ jobs:
     runs-on: ubuntu-latest
     if: github.event.pull_request.user.login == 'release-please[bot]'
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: "Install PHP"
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: "8.2"
       - name: "Install dependencies"
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5805ea725b3..86ba0249a43 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -1,13 +1,10 @@
 name: Release Components
 on:
-    # push:
-    #     tags:
-    #         - "*"
-    workflow_dispatch:
-        inputs:
-            tag:
-                description: 'Tag to release'
-                required: true
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Tag to release'
+        required: true
 permissions:
     contents: read
 jobs:
@@ -19,39 +16,41 @@ jobs:
           RELEASE_TAG: ${{ inputs.tag }}
         steps:
         - name: Clone libgit2
-          uses: actions/checkout@master
+          uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
           with:
             repository: libgit2/libgit2
             ref: v1.5.1
             path: libgit2
+            persist-credentials: false
         - name: Install libgit2
           run: |
             mkdir libgit2/build && cd libgit2/build
             cmake .. -DCMAKE_INSTALL_PREFIX=/usr/local
             sudo cmake --build . --target install
         - name: Clone splitsh/lite
-          uses: actions/checkout@master
+          uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
           with:
             repository: splitsh/lite
             ref: v2.0.0
             path: lite
+            persist-credentials: false
         - name: Build splitsh-lite
           run: |
             cd lite
             go build -o splitsh-lite github.com/splitsh/lite
             mv splitsh-lite /usr/local/bin/splitsh-lite
         - name: Checkout google/cloud
-          uses: actions/checkout@v7
+          uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
           with:
             persist-credentials: false
             fetch-depth: 0
         - name: Setup PHP
-          uses: shivammathur/setup-php@v2
+          uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
           with:
             php-version: '8.2'
             ini-values: memory_limit=2048M
         - name: Install Dependencies
-          uses: nick-fields/retry@v4
+          uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4
           with:
             timeout_minutes: 10
             max_attempts: 3
@@ -62,15 +61,19 @@ jobs:
         - name: Run Subtree Split and Release
           env:
             RELEASE_TAG: ${{ inputs.tag != '' && inputs.tag || steps.getTag.outputs.tag }}
+            VARS_PACKAGIST_USERNAME: ${{ vars.PACKAGIST_USERNAME }}
+            SPLIT_TOKEN: ${{ secrets.SPLIT_TOKEN }}
+            PACKAGIST_TOKEN: ${{ secrets.PACKAGIST_TOKEN }}
+            PACKAGIST_SAFE_TOKEN: ${{ secrets.PACKAGIST_SAFE_TOKEN }}
           run: |
             ./dev/google-cloud split $GITHUB_REPOSITORY $RELEASE_TAG \
               --splitsh=/usr/local/bin/splitsh-lite \
-              -t ${{ secrets.SPLIT_TOKEN }} \
-              --packagist-username=${{ vars.PACKAGIST_USERNAME }} \
-              --packagist-token=${{ secrets.PACKAGIST_TOKEN }} \
-              --packagist-safe-token=${{ secrets.PACKAGIST_SAFE_TOKEN }}
+              -t "$SPLIT_TOKEN" \
+              --packagist-username="${VARS_PACKAGIST_USERNAME}" \
+              --packagist-token="$PACKAGIST_TOKEN" \
+              --packagist-safe-token="$PACKAGIST_SAFE_TOKEN"
         - name: Verify all releases made it to Packagist
-          uses: nick-fields/retry@v4
+          uses: nick-fields/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4
           with:
             command: |
               ./dev/google-cloud release:verify
diff --git a/.github/workflows/system-tests.yaml b/.github/workflows/system-tests.yaml
index e8598f9347b..1d27ad1b791 100644
--- a/.github/workflows/system-tests.yaml
+++ b/.github/workflows/system-tests.yaml
@@ -3,6 +3,10 @@ on:
   # This is failing because we don't have a service account key
   # they need to be moved to kokoro instead
   workflow_dispatch:
+
+permissions:
+  contents: read
+
 jobs:
   # Run system tests on the release PR
   system-tests:
@@ -12,18 +16,22 @@ jobs:
     env:
       ASSET_TEST_BUCKET: cloud-php-testdata
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           fetch-depth: 0
+          persist-credentials: false
       - name: Setup PHP
-        uses: shivammathur/setup-php@verbose
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
         with:
           php-version: "8.1"
           extensions: grpc
           ini-values: grpc.grpc_verbosity=error
       - name: Save secrets to file
+        env:
+          TESTS_KEY: ${{ secrets.GOOGLE_CLOUD_PHP_TESTS_KEY }}
+          RUNNER_TEMP: ${{ runner.temp }}
         run: |
-          echo "${{ secrets.GOOGLE_CLOUD_PHP_TESTS_KEY }}" | base64 -d  > ${{ runner.temp }}/service-account.json
+          echo "$TESTS_KEY" | base64 -d > "$RUNNER_TEMP/service-account.json"
       - name: Install dependencies
         run: composer  --no-interaction --no-ansi --no-progress update
       - name: Run System Tests
diff --git a/.github/workflows/unit-tests.yaml b/.github/workflows/unit-tests.yaml
index e8c1c1225c9..74b22aa8df2 100644
--- a/.github/workflows/unit-tests.yaml
+++ b/.github/workflows/unit-tests.yaml
@@ -32,31 +32,33 @@ jobs:
     runs-on: ${{ matrix.platform }}
     continue-on-error: true
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      with:
+        persist-credentials: false
 
     - name: Setup cache environment
       id: extcache
-      uses: shivammathur/cache-extensions@v1
+      uses: shivammathur/cache-extensions@9b476298b44f2e4d4268dd103ff4c3e216314e27 # v1
       with:
         php-version: ${{ matrix.php }}
         extensions: sodium, sysvshm, ${{ matrix.extensions }}
         key: cache-key-1 # increment to bust the cache
 
     - name: Cache extensions
-      uses: actions/cache@v4
+      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
       with:
         path: ${{ steps.extcache.outputs.dir }}
         key: ${{ steps.extcache.outputs.key }}
         restore-keys: ${{ steps.extcache.outputs.key }}
 
     - name: Setup PHP
-      uses: shivammathur/setup-php@verbose
+      uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
       with:
         php-version: ${{ matrix.php }}
         extensions: sodium, sysvshm, ${{ matrix.extensions }}
 
     - name: Install Dependencies
-      uses: nick-invision/retry@v4
+      uses: nick-invision/retry@ad984534de44a9489a53aefd81eb77f87c70dc60 # v4
       with:
         timeout_minutes: 10
         max_attempts: 3
@@ -74,9 +76,11 @@ jobs:
     name: Package Tests
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      with:
+        persist-credentials: false
     - name: Setup PHP
-      uses: shivammathur/setup-php@verbose
+      uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
       with:
         php-version: '8.1'
         extensions: grpc
@@ -87,9 +91,11 @@ jobs:
     name: Package Tests (Lowest Dependencies)
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      with:
+        persist-credentials: false
     - name: Setup PHP
-      uses: shivammathur/setup-php@verbose
+      uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
       with:
         php-version: '8.1'
         extensions: grpc
@@ -102,9 +108,11 @@ jobs:
     name: Dev Commands Unit Tests
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+      with:
+        persist-credentials: false
     - name: Setup PHP
-      uses: shivammathur/setup-php@verbose
+      uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
       with:
         php-version: "8.2"
     - name: "Install dependencies"
diff --git a/renovate.json b/renovate.json
index cf7b3f32925..9199717a974 100644
--- a/renovate.json
+++ b/renovate.json
@@ -1,6 +1,6 @@
 {
     "extends": [
-        "config:base"
+        "config:best-practices"
     ],
     "pinVersions": false,
     "rebaseStalePrs": true,