diff --git a/.changeset/pin-actions-lockfile.md b/.changeset/pin-actions-lockfile.md
new file mode 100644
index 00000000000..a845151cc84
--- /dev/null
+++ b/.changeset/pin-actions-lockfile.md
@@ -0,0 +1,2 @@
+---
+---
diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
index 50e8c080f05..2ee55472ac8 100644
--- a/.github/actionlint.yaml
+++ b/.github/actionlint.yaml
@@ -7,3 +7,9 @@ self-hosted-runner:
   labels:
     - blacksmith-8vcpu-ubuntu-2204
     - blacksmith-6vcpu-macos-26
+
+paths:
+  .github/workflows/**/*.yml:
+    ignore:
+      # `$/` self-repo action syntax; unsupported by actionlint 1.7.12 (rhysd/actionlint#711)
+      - 'specifying action "\$/[^"]*" in invalid format because ref is missing'
diff --git a/.github/actions/init-blacksmith/action.yml b/.github/actions/init-blacksmith/action.yml
index 4751133eb55..b3718ff9410 100644
--- a/.github/actions/init-blacksmith/action.yml
+++ b/.github/actions/init-blacksmith/action.yml
@@ -48,7 +48,7 @@ runs:
   steps:
     - name: Configure Turborepo
       id: turbo
-      uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+      uses: actions/github-script@v7.1.0
       env:
         # envs are required to pass inputs to the script
         CACHE: ${{ inputs.turbo-cache }}
@@ -110,10 +110,10 @@ runs:
       run: echo $TURBO_ARGS
 
     - name: Install PNPM
-      uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+      uses: pnpm/action-setup@v4.3.0
 
     - name: Setup NodeJS ${{ inputs.node-version }}
-      uses: useblacksmith/setup-node@65c6ca86fdeb0ab3d85e78f57e4f6a7e4780b391 # v5
+      uses: useblacksmith/setup-node@v5.0.4
       with:
         cache: ${{ inputs.cache-enabled == 'true' && 'pnpm' || '' }}
         node-version: ${{ inputs.node-version }}
@@ -139,7 +139,7 @@ runs:
 
     - name: Cache Playwright Binaries
       if: inputs.playwright-enabled == 'true' && inputs.cache-enabled == 'true'
-      uses: useblacksmith/cache@71c7c918062ba3861252d84b07fe5ab2a6b467a6 # v5
+      uses: useblacksmith/cache@v5
       id: playwright-cache
       with:
         path: ~/.cache/ms-playwright
diff --git a/.github/actions/init/action.yml b/.github/actions/init/action.yml
index 317bb090181..5a9234912cd 100644
--- a/.github/actions/init/action.yml
+++ b/.github/actions/init/action.yml
@@ -48,7 +48,7 @@ runs:
   steps:
     - name: Configure Turborepo
       id: turbo
-      uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+      uses: actions/github-script@v7.1.0
       env:
         # envs are required to pass inputs to the script
         CACHE: ${{ inputs.turbo-cache }}
@@ -110,10 +110,10 @@ runs:
       run: echo $TURBO_ARGS
 
     - name: Install PNPM
-      uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+      uses: pnpm/action-setup@v4.3.0
 
     - name: Setup NodeJS ${{ inputs.node-version }}
-      uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      uses: actions/setup-node@v4.4.0
       with:
         cache: ${{ inputs.cache-enabled == 'true' && 'pnpm' || '' }}
         node-version: ${{ inputs.node-version }}
@@ -139,7 +139,7 @@ runs:
 
     - name: Cache Playwright Binaries
       if: inputs.playwright-enabled == 'true' && inputs.cache-enabled == 'true'
-      uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+      uses: actions/cache@v4.3.0
       id: playwright-cache
       with:
         path: ~/.cache/ms-playwright
diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
index 3673053cfee..6022c6f3dae 100644
--- a/.github/workflows/actionlint.yml
+++ b/.github/workflows/actionlint.yml
@@ -24,7 +24,7 @@ jobs:
     timeout-minutes: ${{ vars.TIMEOUT_MINUTES_SHORT && fromJSON(vars.TIMEOUT_MINUTES_SHORT) || 5 }}
     steps:
       - name: Checkout repo
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@v4.4.0
         with:
           persist-credentials: false
           show-progress: false
@@ -41,3 +41,26 @@ jobs:
           SHELLCHECK_OPTS: --exclude=SC2086,SC2129,SC2162
         with:
           args: -color
+
+  actions-lock:
+    name: Verify actions lockfile
+    runs-on: ${{ vars.RUNNER_NORMAL || 'ubuntu-latest' }}
+    timeout-minutes: ${{ vars.TIMEOUT_MINUTES_SHORT && fromJSON(vars.TIMEOUT_MINUTES_SHORT) || 5 }}
+    steps:
+      - name: Checkout repo
+        uses: actions/checkout@v4.4.0
+        with:
+          persist-credentials: false
+          show-progress: false
+          sparse-checkout: .github
+          sparse-checkout-cone-mode: false
+
+      - name: Install gh-actions-lock
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh extension install github/gh-actions-lock --pin v0.2.0
+
+      - name: Verify every workflow dependency is locked
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh actions-lock --verify
diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
new file mode 100644
index 00000000000..4773368e453
--- /dev/null
+++ b/.github/workflows/actions.lock
@@ -0,0 +1,229 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.3'
+workflows:
+    '.github/workflows/actionlint.yml':
+        - 'actions/checkout@v4.4.0'
+    '.github/workflows/api-changes.yml':
+        - 'actions/checkout@v4.4.0'
+        - 'actions/github-script@v7.1.0'
+        - 'actions/upload-artifact@v4.6.2'
+        - 'clerk/break-check@v0.6.0'
+        - 'pnpm/action-setup@v4.3.0'
+        - 'useblacksmith/cache@v5'
+        - 'useblacksmith/setup-node@v5.0.4'
+    '.github/workflows/ci.yml':
+        - 'actions-cool/check-user-permission@v2.4.0'
+        - 'actions/checkout@v4.4.0'
+        - 'actions/github-script@v7.1.0'
+        - 'actions/upload-artifact@v4.6.2'
+        - 'pnpm/action-setup@v4.3.0'
+        - 'useblacksmith/cache@v5'
+        - 'useblacksmith/setup-node@v5.0.4'
+    '.github/workflows/e2e-cleanups.yml':
+        - 'actions/cache@v4.3.0'
+        - 'actions/checkout@v4.4.0'
+        - 'actions/github-script@v7.1.0'
+        - 'actions/setup-node@v4.4.0'
+        - 'pnpm/action-setup@v4.3.0'
+    '.github/workflows/e2e-staging.yml':
+        - 'actions/checkout@v4.4.0'
+        - 'actions/github-script@v7.1.0'
+        - 'actions/upload-artifact@v4.6.2'
+        - 'pnpm/action-setup@v4.3.0'
+        - 'slackapi/slack-github-action@v1.27.1'
+        - 'useblacksmith/cache@v5'
+        - 'useblacksmith/setup-node@v5.0.4'
+    '.github/workflows/electron-passkeys.yml':
+        - 'actions/checkout@v4.4.0'
+        - 'actions/download-artifact@v4.3.0'
+        - 'actions/setup-node@v4.4.0'
+        - 'actions/upload-artifact@v4.6.2'
+        - 'dtolnay/rust-toolchain@v1'
+        - 'pnpm/action-setup@v4.3.0'
+        - 'swatinem/rust-cache@v2.9.2'
+    '.github/workflows/expo-native-build.yml':
+        - 'actions/cache@v4.3.0'
+        - 'actions/checkout@v4.4.0'
+        - 'actions/setup-java@v4.9.1'
+        - 'actions/setup-node@v4.4.0'
+        - 'actions/upload-artifact@v4.6.2'
+        - 'gradle/actions@v6.3.0'
+        - 'pnpm/action-setup@v4.3.0'
+        - 'reactivecircus/android-emulator-runner@v2.38.0'
+    '.github/workflows/labeler-apply.yml':
+        - 'actions/checkout@v4.4.0'
+        - 'actions/download-artifact@v4.3.0'
+        - 'actions/github-script@v7.1.0'
+        - 'actions/labeler@v6.2.0'
+    '.github/workflows/labeler.yml':
+        - 'actions/upload-artifact@v4.6.2'
+    '.github/workflows/lock-threads.yml':
+        - 'actions/stale@v9.1.0'
+        - 'dessant/lock-threads@v4.0.1'
+    '.github/workflows/major-version-check.yml':
+        - 'actions/github-script@v7.1.0'
+    '.github/workflows/nightly-checks.yml':
+        - 'actions/cache@v4.3.0'
+        - 'actions/checkout@v4.4.0'
+        - 'actions/github-script@v7.1.0'
+        - 'actions/setup-node@v4.4.0'
+        - 'actions/upload-artifact@v4.6.2'
+        - 'pnpm/action-setup@v4.3.0'
+        - 'ravsamhq/notify-slack-action@1.10.0'
+    '.github/workflows/pr-title-linter.yml':
+        - 'actions/checkout@v4.4.0'
+    '.github/workflows/release-preflight.yml':
+        - 'actions/cache@v4.3.0'
+        - 'actions/checkout@v4.4.0'
+        - 'actions/github-script@v7.1.0'
+        - 'actions/setup-node@v4.4.0'
+        - 'actions/upload-artifact@v4.6.2'
+        - 'pnpm/action-setup@v4.3.0'
+    '.github/workflows/release.yml':
+        - 'actions/cache@v4.3.0'
+        - 'actions/checkout@v4.4.0'
+        - 'actions/github-script@v7.1.0'
+        - 'actions/setup-node@v4.4.0'
+        - 'changesets/action@v1.8.0'
+        - 'dawidd6/action-download-artifact@v21'
+        - 'peter-evans/create-or-update-comment@v3.1.0'
+        - 'pnpm/action-setup@v4.3.0'
+        - 'slackapi/slack-github-action@v1.27.1'
+    '.github/workflows/validate-renovate-config.yml':
+        - 'actions/checkout@v4.4.0'
+dependencies:
+    'actions-cool/check-user-permission@v2.4.0':
+        ref: 'v2.4.0'
+        commit: 'sha1-c21884f3dda18dafc2f8b402fe807ccc9ec1aa5e'
+        owner_id: 73879334
+        repo_id: 344485868
+    'actions/cache@v4.3.0':
+        ref: 'v4.3.0'
+        commit: 'sha1-0057852bfaa89a56745cba8c7296529d2fc39830'
+        owner_id: 44036562
+        repo_id: 215566462
+    'actions/checkout@v4.4.0':
+        ref: 'v4.4.0'
+        commit: 'sha1-11d5960a326750d5838078e36cf38b85af677262'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/download-artifact@v4.3.0':
+        ref: 'v4.3.0'
+        commit: 'sha1-d3f86a106a0bac45b974a628896c90dbdf5c8093'
+        owner_id: 44036562
+        repo_id: 192626254
+    'actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3':
+        ref: 'v9.0.0'
+        commit: 'sha1-3a2844b7e9c422d3c10d287c895573f7108da1b3'
+        owner_id: 44036562
+        repo_id: 205262760
+    'actions/github-script@v7.1.0':
+        ref: 'v7.1.0'
+        commit: 'sha1-f28e40c7f34bde8b3046d885e986cb6290c5673b'
+        owner_id: 44036562
+        repo_id: 205262760
+    'actions/labeler@v6.2.0':
+        ref: 'v6.2.0'
+        commit: 'sha1-b8dd2d9be0f68b860e7dae5dae7d772984eacd6d'
+        owner_id: 44036562
+        repo_id: 177139928
+    'actions/setup-java@v4.9.1':
+        ref: 'v4.9.1'
+        commit: 'sha1-cf277c60eb25467037889841efdb72551f06f6c3'
+        owner_id: 44036562
+        repo_id: 196057608
+    'actions/setup-node@v4.4.0':
+        ref: 'v4.4.0'
+        commit: 'sha1-49933ea5288caeca8642d1e84afbd3f7d6820020'
+        owner_id: 44036562
+        repo_id: 189476904
+    'actions/stale@v9.1.0':
+        ref: 'v9.1.0'
+        commit: 'sha1-5bef64f19d7facfb25b37b414482c7164d639639'
+        owner_id: 44036562
+        repo_id: 200437066
+    'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02':
+        ref: 'v4.6.2'
+        commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
+        owner_id: 44036562
+        repo_id: 192625955
+    'actions/upload-artifact@v4.6.2':
+        ref: 'v4.6.2'
+        commit: 'sha1-ea165f8d65b6e75b540449e92b4886f43607fa02'
+        owner_id: 44036562
+        repo_id: 192625955
+    'changesets/action@v1.8.0':
+        ref: 'v1.8.0'
+        commit: 'sha1-63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b'
+        owner_id: 51163350
+        repo_id: 202093906
+    'clerk/break-check@v0.6.0':
+        ref: 'v0.6.0'
+        commit: 'sha1-92be9cc726c848b9567c7b869e9b11dc761ddd6e'
+        owner_id: 49538330
+        repo_id: 1140987013
+        uses:
+            - 'actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3'
+            - 'actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02'
+    'dawidd6/action-download-artifact@v21':
+        ref: 'v21'
+        commit: 'sha1-b6e2e70617bc3265edd6dab6c906732b2f1ae151'
+        owner_id: 9713907
+        repo_id: 239218448
+    'dessant/lock-threads@v4.0.1':
+        ref: 'v4.0.1'
+        commit: 'sha1-be8aa5be94131386884a6da4189effda9b14aa21'
+        owner_id: 7513068
+        repo_id: 113918130
+    'dtolnay/rust-toolchain@v1':
+        ref: 'v1'
+        commit: 'sha1-e2a55d2ffb04f378e9626c28d38b36d230d1e12f'
+        owner_id: 1940490
+        repo_id: 260749683
+    'gradle/actions@v6.3.0':
+        ref: 'v6.3.0'
+        commit: 'sha1-9c971963bec38e04b3d30dcc455b5382be2fdbfb'
+        owner_id: 124156
+        repo_id: 743626948
+    'peter-evans/create-or-update-comment@v3.1.0':
+        ref: 'v3.1.0'
+        commit: 'sha1-23ff15729ef2fc348714a3bb66d2f655ca9066f2'
+        owner_id: 18365890
+        repo_id: 223708643
+    'pnpm/action-setup@v4.3.0':
+        ref: 'v4.3.0'
+        commit: 'sha1-b906affcce14559ad1aafd4ab0e942779e9f58b1'
+        owner_id: 21320719
+        repo_id: 262289747
+    'ravsamhq/notify-slack-action@1.10.0':
+        ref: '1.10.0'
+        commit: 'sha1-4ed28566c2bdcdaee6dca2b46b9666d01b4ed8a4'
+        owner_id: 56475783
+        repo_id: 280818415
+    'reactivecircus/android-emulator-runner@v2.38.0':
+        ref: 'v2.38.0'
+        commit: 'sha1-a421e43855164a8197daf9d8d40fe71c6996bb0d'
+        owner_id: 51352484
+        repo_id: 219782401
+    'slackapi/slack-github-action@v1.27.1':
+        ref: 'v1.27.1'
+        commit: 'sha1-fcfb566f8b0aab22203f066d80ca1d7e4b5d05b3'
+        owner_id: 6962987
+        repo_id: 306439799
+    'swatinem/rust-cache@v2.9.2':
+        ref: 'v2.9.2'
+        commit: 'sha1-6323deb102c322ba6fcbdcafc7e3dddab59af2b6'
+        owner_id: 580492
+        repo_id: 298565987
+    'useblacksmith/cache@v5':
+        ref: 'v5'
+        commit: 'sha1-71c7c918062ba3861252d84b07fe5ab2a6b467a6'
+        owner_id: 156274793
+        repo_id: 746418836
+    'useblacksmith/setup-node@v5.0.4':
+        ref: 'v5.0.4'
+        commit: 'sha1-65c6ca86fdeb0ab3d85e78f57e4f6a7e4780b391'
+        owner_id: 156274793
+        repo_id: 753445610
diff --git a/.github/workflows/api-changes.yml b/.github/workflows/api-changes.yml
index 9feadb28f55..1c6d054f6f8 100644
--- a/.github/workflows/api-changes.yml
+++ b/.github/workflows/api-changes.yml
@@ -92,14 +92,14 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@v4.4.0
         with:
           persist-credentials: false
           filter: 'blob:none'
           show-progress: false
 
       - name: Setup
-        uses: ./.github/actions/init-blacksmith
+        uses: $/.github/actions/init-blacksmith
         with:
           cache-enabled: true
           turbo-signature: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
@@ -115,7 +115,7 @@ jobs:
             --output "$GITHUB_WORKSPACE/.api-snapshots-baseline"
 
       - name: Upload baseline artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: break-check-baseline
           path: .api-snapshots-baseline
@@ -144,7 +144,7 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@v4.4.0
         with:
           # Check out the PR head commit, not the refs/pull/N/merge ref that
           # checkout resolves by default (it absorbs base-branch drift, so once
@@ -161,7 +161,7 @@ jobs:
           show-progress: false
 
       - name: Setup
-        uses: ./.github/actions/init-blacksmith
+        uses: $/.github/actions/init-blacksmith
         with:
           cache-enabled: true
           turbo-signature: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
@@ -176,7 +176,7 @@ jobs:
         run: echo "BREAK_CHECK_FILTERS=$BREAK_CHECK_FILTERS" >> "$GITHUB_ENV"
 
       - name: Break Check
-        uses: clerk/break-check@92be9cc726c848b9567c7b869e9b11dc761ddd6e # v0.6.0
+        uses: clerk/break-check@v0.6.0
         with:
           break-check-version: '0.6.0'
           # The PR head is already checked out, so build it in place rather than
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ee010ea28b4..6377781ef65 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -31,7 +31,7 @@ jobs:
       - name: Get User Permission
         if: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name != github.repository }}
         id: checkAccess
-        uses: actions-cool/check-user-permission@c21884f3dda18dafc2f8b402fe807ccc9ec1aa5e # v2
+        uses: actions-cool/check-user-permission@v2.4.0
         with:
           require: write
           username: ${{ github.triggering_actor }}
@@ -56,7 +56,7 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@v4.4.0
         with:
           persist-credentials: false
           fetch-depth: 100 # Enough for changeset status comparison, much faster than full history
@@ -69,7 +69,7 @@ jobs:
 
       - name: Setup
         id: config
-        uses: ./.github/actions/init-blacksmith
+        uses: $/.github/actions/init-blacksmith
         with:
           cache-enabled: true
           turbo-signature: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
@@ -120,7 +120,7 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@v4.4.0
         with:
           persist-credentials: false
           fetch-depth: 1
@@ -130,7 +130,7 @@ jobs:
 
       - name: Setup
         id: config
-        uses: ./.github/actions/init-blacksmith
+        uses: $/.github/actions/init-blacksmith
         with:
           cache-enabled: true
           turbo-signature: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
@@ -142,7 +142,7 @@ jobs:
         run: pnpm turbo build $TURBO_ARGS --only
 
       - name: Upload Turbo Summary
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@v4.6.2
         if: ${{ env.TURBO_SUMMARIZE == 'true' }}
         continue-on-error: true
         with:
@@ -163,7 +163,7 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@v4.4.0
         with:
           persist-credentials: false
           fetch-depth: 1
@@ -173,7 +173,7 @@ jobs:
 
       - name: Setup
         id: config
-        uses: ./.github/actions/init-blacksmith
+        uses: $/.github/actions/init-blacksmith
         with:
           cache-enabled: true
           turbo-signature: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
@@ -209,7 +209,7 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@v4.4.0
         with:
           persist-credentials: false
           fetch-depth: 1
@@ -219,7 +219,7 @@ jobs:
 
       - name: Setup
         id: config
-        uses: ./.github/actions/init-blacksmith
+        uses: $/.github/actions/init-blacksmith
         with:
           cache-enabled: true
           turbo-signature: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
@@ -237,7 +237,7 @@ jobs:
         run: pnpm turbo lint $TURBO_ARGS
 
       - name: Upload Turbo Summary
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@v4.6.2
         if: ${{ env.TURBO_SUMMARIZE == 'true' }}
         continue-on-error: true
         with:
@@ -272,7 +272,7 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@v4.4.0
         with:
           persist-credentials: false
           fetch-depth: 1
@@ -282,7 +282,7 @@ jobs:
 
       - name: Setup
         id: config
-        uses: ./.github/actions/init-blacksmith
+        uses: $/.github/actions/init-blacksmith
         with:
           cache-enabled: true
           # Ensures that all builds are cached appropriately with a consistent run name `Unit Tests (20)`.
@@ -315,7 +315,7 @@ jobs:
           NODE_VERSION: ${{ matrix.node-version }}
 
       - name: Upload Turbo Summary
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@v4.6.2
         if: ${{ env.TURBO_SUMMARIZE == 'true' }}
         continue-on-error: true
         with:
@@ -336,7 +336,7 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@v4.4.0
         with:
           persist-credentials: false
           fetch-depth: 1
@@ -345,7 +345,7 @@ jobs:
           show-progress: false
 
       - name: Setup
-        uses: ./.github/actions/init-blacksmith
+        uses: $/.github/actions/init-blacksmith
         with:
           cache-enabled: true
           playwright-enabled: true
@@ -361,7 +361,7 @@ jobs:
 
       - name: Upload failure artifacts
         if: ${{ cancelled() || failure() }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: mosaic-feature-failure-artifacts-${{ github.run_id }}-${{ github.run_attempt }}
           path: packages/mosaic/.vitest/attachments
@@ -431,7 +431,7 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@v4.4.0
         with:
           persist-credentials: false
           fetch-depth: 1
@@ -441,7 +441,7 @@ jobs:
 
       - name: Setup
         id: config
-        uses: ./.github/actions/init-blacksmith
+        uses: $/.github/actions/init-blacksmith
         with:
           cache-enabled: true
           turbo-signature: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
@@ -525,7 +525,7 @@ jobs:
         run: cd packages/astro && pnpm copy:components
 
       - name: Write all ENV certificates to files in integration/certs
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        uses: actions/github-script@v7.1.0
         env:
           INTEGRATION_CERTS: '${{secrets.INTEGRATION_CERTS}}'
           INTEGRATION_ROOT_CA: '${{secrets.INTEGRATION_ROOT_CA}}'
@@ -596,7 +596,7 @@ jobs:
 
       - name: Upload test-results
         if: ${{ cancelled() || failure() }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: playwright-traces-${{ github.run_id }}-${{ github.run_attempt }}-${{ steps.sanitize.outputs.artifact-suffix }}${{ matrix.next-version && format('-next{0}', matrix.next-version) || '' }}
           path: integration/test-results
@@ -625,7 +625,7 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@v4.4.0
         with:
           persist-credentials: false
           fetch-depth: 1
@@ -634,7 +634,7 @@ jobs:
           show-progress: false
 
       - name: Setup Node
-        uses: ./.github/actions/init-blacksmith
+        uses: $/.github/actions/init-blacksmith
         with:
           cache-enabled: true
           turbo-enabled: true
diff --git a/.github/workflows/e2e-cleanups.yml b/.github/workflows/e2e-cleanups.yml
index 2c8b9d50882..383332d48f6 100644
--- a/.github/workflows/e2e-cleanups.yml
+++ b/.github/workflows/e2e-cleanups.yml
@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@v4.4.0
         with:
           persist-credentials: false
           fetch-depth: 0
@@ -24,7 +24,7 @@ jobs:
 
       - name: Setup
         id: config
-        uses: ./.github/actions/init
+        uses: $/.github/actions/init
         with:
           cache-enabled: true
           turbo-signature: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
diff --git a/.github/workflows/e2e-staging.yml b/.github/workflows/e2e-staging.yml
index 0454bdd60b6..3d99a351fab 100644
--- a/.github/workflows/e2e-staging.yml
+++ b/.github/workflows/e2e-staging.yml
@@ -46,7 +46,7 @@ jobs:
     runs-on: 'blacksmith-8vcpu-ubuntu-2204'
     steps:
       - name: Check org membership
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        uses: actions/github-script@v7.1.0
         with:
           script: |
             const org = context.repo.owner;
@@ -100,7 +100,7 @@ jobs:
           fi
 
       - name: Checkout Repo
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@v4.4.0
         with:
           persist-credentials: false
           ref: ${{ steps.inputs.outputs.ref }}
@@ -187,7 +187,7 @@ jobs:
           fi
 
       - name: Checkout Repo
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@v4.4.0
         with:
           persist-credentials: false
           ref: ${{ steps.inputs.outputs.ref }}
@@ -196,10 +196,15 @@ jobs:
           filter: 'blob:none'
           show-progress: false
 
+      - name: Read Node version from checked-out ref
+        id: nvmrc
+        run: echo "node-version=$(tr -d 'v[:space:]' < .nvmrc)" >> "$GITHUB_OUTPUT"
+
       - name: Setup
         id: config
-        uses: ./.github/actions/init-blacksmith
+        uses: $/.github/actions/init-blacksmith
         with:
+          node-version: ${{ steps.nvmrc.outputs.node-version }}
           cache-enabled: true
           turbo-signature: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
           turbo-team: ${{ vars.TURBO_TEAM }}
@@ -260,7 +265,7 @@ jobs:
           pnpm add @clerk/ui@latest
 
       - name: Write all ENV certificates to files in integration/certs
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        uses: actions/github-script@v7.1.0
         env:
           INTEGRATION_CERTS: '${{ secrets.INTEGRATION_CERTS }}'
           INTEGRATION_ROOT_CA: '${{ secrets.INTEGRATION_ROOT_CA }}'
@@ -305,7 +310,7 @@ jobs:
 
       - name: Upload test-results
         if: ${{ cancelled() || failure() }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: playwright-traces-${{ github.run_id }}-${{ github.run_attempt }}-${{ steps.inputs.outputs.artifact-suffix }}
           path: test-results
@@ -319,7 +324,7 @@ jobs:
       # so a future path regression surfaces in the logs instead of failing silently.
       - name: Upload Playwright JSON report
         if: ${{ !cancelled() }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: playwright-report-${{ github.run_id }}-${{ github.run_attempt }}-${{ steps.inputs.outputs.artifact-suffix }}
           path: integration/playwright-report/results.json
@@ -365,7 +370,7 @@ jobs:
 
       - name: Notify Slack on failure
         if: ${{ (needs.integration-tests.result == 'failure' || needs.validate-instances.result == 'failure') && steps.inputs.outputs.notify-slack == 'true' }}
-        uses: slackapi/slack-github-action@fcfb566f8b0aab22203f066d80ca1d7e4b5d05b3 # v1.27.1
+        uses: slackapi/slack-github-action@v1.27.1
         with:
           payload: |
             {
diff --git a/.github/workflows/electron-passkeys.yml b/.github/workflows/electron-passkeys.yml
index a2b395abad5..03580c6e1da 100644
--- a/.github/workflows/electron-passkeys.yml
+++ b/.github/workflows/electron-passkeys.yml
@@ -31,22 +31,22 @@ jobs:
       run:
         working-directory: packages/electron-passkeys
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@v4.4.0
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      - uses: actions/setup-node@v4.4.0
         with:
           node-version: 24
 
-      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+      - uses: pnpm/action-setup@v4.3.0
 
-      - uses: dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
+      - uses: dtolnay/rust-toolchain@v1
         with:
           toolchain: stable
           targets: ${{ matrix.settings.target }}
 
-      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2
+      - uses: Swatinem/rust-cache@v2.9.2
         with:
           workspaces: packages/electron-passkeys
 
@@ -61,7 +61,7 @@ jobs:
         if: matrix.settings.target == 'aarch64-apple-darwin' || matrix.settings.target == 'x86_64-pc-windows-msvc'
         run: node -e "const m = require('./index.js'); console.log('isAvailable:', m.isAvailable(), 'capabilities:', JSON.stringify(m.capabilities())); if (!m.isAvailable()) throw new Error('the loader did not find the freshly built native binary');"
 
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      - uses: actions/upload-artifact@v4.6.2
         with:
           name: bindings-${{ matrix.settings.target }}
           path: packages/electron-passkeys/electron-passkeys.*.node
@@ -76,21 +76,21 @@ jobs:
       run:
         working-directory: packages/electron-passkeys
     steps:
-      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/checkout@v4.4.0
         with:
           persist-credentials: false
 
-      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+      - uses: actions/setup-node@v4.4.0
         with:
           node-version: 24
 
-      - uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+      - uses: pnpm/action-setup@v4.3.0
 
       - name: Install dependencies
         run: pnpm install --filter @clerk/electron-passkeys... --frozen-lockfile --ignore-scripts
         working-directory: .
 
-      - uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+      - uses: actions/download-artifact@v4.3.0
         with:
           path: packages/electron-passkeys/artifacts
 
@@ -102,7 +102,7 @@ jobs:
         working-directory: .
 
       - name: Upload assembled platform binaries
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: electron-passkeys-npm
           path: packages/electron-passkeys/npm/**/*.node
diff --git a/.github/workflows/expo-native-build.yml b/.github/workflows/expo-native-build.yml
index 7b4731cc6fe..561e5cde57f 100644
--- a/.github/workflows/expo-native-build.yml
+++ b/.github/workflows/expo-native-build.yml
@@ -68,7 +68,7 @@ jobs:
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@v4.4.0
         with:
           persist-credentials: false
 
@@ -105,16 +105,16 @@ jobs:
 
       - name: Restore native build
         id: native-build-cache
-        uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache/restore@v4.3.0
         with:
           path: ${{ steps.native-build-key.outputs.artifact }}
           # Bump the version when native build commands change.
           key: expo-native-build-v1-${{ runner.os }}-${{ matrix.expo-sdk }}-${{ matrix.platform }}-${{ matrix.run-e2e == true && 'e2e' || 'build' }}-${{ env.E2E_INSTANCE_NAME }}-${{ steps.native-build-key.outputs.hash }}
 
       - if: steps.native-build-cache.outputs.cache-hit != 'true' || matrix.run-e2e == true
-        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4
+        uses: pnpm/action-setup@v4.3.0
       - if: steps.native-build-cache.outputs.cache-hit != 'true' || matrix.run-e2e == true
-        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        uses: actions/setup-node@v4.4.0
         with:
           node-version: 24.15.0
           cache: pnpm
@@ -194,14 +194,14 @@ jobs:
 
       - name: Set up JDK 17
         if: matrix.platform == 'android'
-        uses: actions/setup-java@cf277c60eb25467037889841efdb72551f06f6c3 # v4
+        uses: actions/setup-java@v4.9.1
         with:
           distribution: temurin
           java-version: 17
 
       - name: Set up Gradle cache
         if: matrix.platform == 'android' && steps.native-build-cache.outputs.cache-hit != 'true'
-        uses: gradle/actions/setup-gradle@4733eaac7c1b0da527e4206b7671e0061de1ce37 # v6.3.0
+        uses: gradle/actions/setup-gradle@v6.3.0
         with:
           # This workflow never runs on main, so the default (write from main
           # only) would never seed the cache.
@@ -239,7 +239,7 @@ jobs:
 
       - name: Save native build
         if: steps.native-build-cache.outputs.cache-hit != 'true'
-        uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache/save@v4.3.0
         with:
           path: ${{ steps.native-build-key.outputs.artifact }}
           key: ${{ steps.native-build-cache.outputs.cache-primary-key }}
@@ -250,7 +250,7 @@ jobs:
 
       - name: Cache iOS automation runner
         if: matrix.platform == 'ios' && steps.keys.outputs.pk != ''
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache@v4.3.0
         with:
           path: ~/.agent-device
           key: agent-device-${{ runner.os }}-${{ hashFiles('pnpm-lock.yaml') }}
@@ -286,7 +286,7 @@ jobs:
       - name: AVD cache
         id: avd-cache
         if: matrix.platform == 'android' && steps.keys.outputs.sk != ''
-        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4
+        uses: actions/cache@v4.3.0
         with:
           path: |
             ~/.android/avd/*
@@ -295,7 +295,7 @@ jobs:
 
       - name: Create AVD snapshot
         if: matrix.platform == 'android' && steps.keys.outputs.sk != '' && steps.avd-cache.outputs.cache-hit != 'true'
-        uses: reactivecircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d # v2
+        uses: reactivecircus/android-emulator-runner@v2.38.0
         with:
           api-level: 34
           target: google_apis
@@ -308,7 +308,7 @@ jobs:
       - name: Run Android e2e
         id: run_e2e_android
         if: matrix.platform == 'android' && steps.keys.outputs.sk != ''
-        uses: reactivecircus/android-emulator-runner@a421e43855164a8197daf9d8d40fe71c6996bb0d # v2
+        uses: reactivecircus/android-emulator-runner@v2.38.0
         env:
           CLERK_SECRET_KEY: ${{ steps.keys.outputs.sk }}
           CLERK_API_URL: ${{ env.BAPI_URL }}
@@ -341,7 +341,7 @@ jobs:
 
       - name: Upload e2e artifacts
         if: always() && steps.keys.outputs.sk != ''
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: e2e-${{ matrix.platform }}
           include-hidden-files: true
diff --git a/.github/workflows/labeler-apply.yml b/.github/workflows/labeler-apply.yml
index a3932f0b93a..5d513a940b5 100644
--- a/.github/workflows/labeler-apply.yml
+++ b/.github/workflows/labeler-apply.yml
@@ -29,14 +29,14 @@ jobs:
       pull-requests: write # apply labels
     steps:
       - name: Download PR number
-        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4
+        uses: actions/download-artifact@v4.3.0
         with:
           name: pr-number
           run-id: ${{ github.event.workflow_run.id }}
           github-token: ${{ secrets.GITHUB_TOKEN }}
       - name: Resolve and verify PR number
         id: pr
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        uses: actions/github-script@v7.1.0
         with:
           script: |
             const fs = require('fs');
@@ -64,12 +64,12 @@ jobs:
             }
             core.setOutput('number', raw);
       - name: Check out trusted labeler config
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@v4.4.0
         with:
           sparse-checkout: .github/labeler.yml
           sparse-checkout-cone-mode: false
           persist-credentials: false
-      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6
+      - uses: actions/labeler@v6.2.0
         with:
           pr-number: ${{ steps.pr.outputs.number }}
           configuration-path: .github/labeler.yml
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index 1c68d4b93f7..e007d913ea0 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -22,7 +22,7 @@ jobs:
         run: |
           mkdir -p ./pr
           echo "$PR_NUMBER" > ./pr/number
-      - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+      - uses: actions/upload-artifact@v4.6.2
         with:
           name: pr-number
           path: ./pr/
diff --git a/.github/workflows/lock-threads.yml b/.github/workflows/lock-threads.yml
index 8a450c2fad3..8b7218d1398 100644
--- a/.github/workflows/lock-threads.yml
+++ b/.github/workflows/lock-threads.yml
@@ -19,7 +19,7 @@ jobs:
     timeout-minutes: 3
     runs-on: ${{ vars.RUNNER_NORMAL || 'ubuntu-latest' }}
     steps:
-      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9
+      - uses: actions/stale@v9.1.0
         name: Regular stale action
         with:
           days-before-issue-stale: 30
@@ -56,7 +56,7 @@ jobs:
             After 60 days of no activity, we'll close this PR. Keep in mind, I'm just a robot, so if I've closed this PR in error, please reply here and my human colleagues will reopen it.
 
             Thanks for being a part of the Clerk community! 🙏
-      - uses: actions/stale@5bef64f19d7facfb25b37b414482c7164d639639 # v9
+      - uses: actions/stale@v9.1.0
         name: Stale action for needs-reproduction issues
         with:
           days-before-issue-stale: 7
@@ -73,7 +73,7 @@ jobs:
             Thanks for being a part of the Clerk community! 🙏
           close-issue-message: |
             After 8 days without a reproduction being supplied, we are closing this issue. Keep in mind, I'm just a robot, so if I've closed this issue in error, please reply here and my human colleagues will reopen it. Likewise if a reproduction is prepared after it has been closed.
-      - uses: dessant/lock-threads@be8aa5be94131386884a6da4189effda9b14aa21 # v4
+      - uses: dessant/lock-threads@v4.0.1
         with:
           issue-inactive-days: '365'
           issue-comment: 'This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.'
diff --git a/.github/workflows/major-version-check.yml b/.github/workflows/major-version-check.yml
index 1ce7746bc8a..7f8eb39b796 100644
--- a/.github/workflows/major-version-check.yml
+++ b/.github/workflows/major-version-check.yml
@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check for unapproved major changesets
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        uses: actions/github-script@v7.1.0
         with:
           script: |
             const STATUS_CONTEXT = 'Major Version Check';
diff --git a/.github/workflows/nightly-checks.yml b/.github/workflows/nightly-checks.yml
index 429050b62e7..e2e36b6d20f 100644
--- a/.github/workflows/nightly-checks.yml
+++ b/.github/workflows/nightly-checks.yml
@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@v4.4.0
         with:
           persist-credentials: false
           fetch-depth: 1
@@ -29,7 +29,7 @@ jobs:
 
       - name: Setup
         id: config
-        uses: ./.github/actions/init
+        uses: $/.github/actions/init
         with:
           cache-enabled: true
           turbo-signature: ${{ secrets.TURBO_REMOTE_CACHE_SIGNATURE_KEY }}
@@ -118,7 +118,7 @@ jobs:
       # Upload test artifacts if tests failed
       - name: Upload Test Artifacts
         if: steps.integration_tests.outputs.exit_code != '0'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: test-artifacts-${{ matrix.test-name }}
           path: |
@@ -137,7 +137,7 @@ jobs:
 
       - name: Report Status
         if: always()
-        uses: ravsamhq/notify-slack-action@4ed28566c2bdcdaee6dca2b46b9666d01b4ed8a4 # v1
+        uses: ravsamhq/notify-slack-action@1.10.0
         with:
           status: ${{ steps.integration_tests.outputs.exit_code == '0' && 'success' || 'failure' }}
           notify_when: "failure"
diff --git a/.github/workflows/pr-title-linter.yml b/.github/workflows/pr-title-linter.yml
index 0d3f26f9a0c..4e598205c4a 100644
--- a/.github/workflows/pr-title-linter.yml
+++ b/.github/workflows/pr-title-linter.yml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@v4.4.0
         with:
           persist-credentials: false
           show-progress: false
diff --git a/.github/workflows/release-preflight.yml b/.github/workflows/release-preflight.yml
index 8c59579c60d..128b8864cd2 100644
--- a/.github/workflows/release-preflight.yml
+++ b/.github/workflows/release-preflight.yml
@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@v4.4.0
         with:
           persist-credentials: false
           fetch-depth: 100
@@ -31,7 +31,7 @@ jobs:
         run: git fetch origin main:refs/remotes/origin/main --depth=100
 
       - name: Setup
-        uses: ./.github/actions/init
+        uses: $/.github/actions/init
         with:
           cache-enabled: true
           turbo-enabled: false
@@ -92,7 +92,7 @@ jobs:
 
       - name: Upload preflight artifacts
         if: always()
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@v4.6.2
         with:
           name: release-preflight-artifacts
           path: .release-artifacts/
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 54eef60b355..36dcd6ca4f3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -67,7 +67,7 @@ jobs:
           GITHUB_CONTEXT: ${{ toJson(github) }}
 
       - name: Checkout repo
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@v4.4.0
         with:
           fetch-depth: 0
           show-progress: false
@@ -79,7 +79,7 @@ jobs:
 
       - name: Setup
         id: config
-        uses: ./.github/actions/init
+        uses: $/.github/actions/init
         with:
           cache-enabled: false # OIDC publish job; do not restore poisonable cache state.
           turbo-enabled: false # Release uses --force, so turbo cache is not needed
@@ -98,7 +98,7 @@ jobs:
 
       - name: Download electron-passkeys native binaries
         if: ${{ steps.detect-native.outputs.should-build == 'true' }}
-        uses: dawidd6/action-download-artifact@b6e2e70617bc3265edd6dab6c906732b2f1ae151 # v21
+        uses: dawidd6/action-download-artifact@v21
         with:
           github_token: ${{ github.token }}
           workflow: electron-passkeys.yml
@@ -116,7 +116,7 @@ jobs:
 
       - name: Create Release PR
         id: changesets
-        uses: changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b # v1
+        uses: changesets/action@v1.8.0
         with:
           commit: "ci(repo): Version packages"
           title: "ci(repo): Version packages"
@@ -130,7 +130,7 @@ jobs:
 
       - name: Trigger workflows on related repos
         if: steps.changesets.outputs.published == 'true'
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        uses: actions/github-script@v7.1.0
         with:
           result-encoding: string
           retries: 3
@@ -178,7 +178,7 @@ jobs:
       # if the packages are already live.
       - name: Recover downstream notifications
         if: always() && steps.changesets.conclusion == 'failure'
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        uses: actions/github-script@v7.1.0
         with:
           result-encoding: string
           retries: 3
@@ -276,7 +276,7 @@ jobs:
       - name: Send commit log to Slack
         id: slack
         if: ${{ !cancelled() && steps.changesets.outputs.published == 'true' && steps.notification.outcome == 'success' }}
-        uses: slackapi/slack-github-action@fcfb566f8b0aab22203f066d80ca1d7e4b5d05b3 # v1.27.1
+        uses: slackapi/slack-github-action@v1.27.1
         with:
           payload: ${{ steps.notification.outputs.payload }}
         env:
@@ -285,7 +285,7 @@ jobs:
 
       - name: Notify Slack on failure
         if: ${{ always() && steps.changesets.outcome == 'failure' }}
-        uses: slackapi/slack-github-action@fcfb566f8b0aab22203f066d80ca1d7e4b5d05b3 # v1.27.1
+        uses: slackapi/slack-github-action@v1.27.1
         with:
           payload: |
             {
@@ -313,7 +313,7 @@ jobs:
       id-token: write
     steps:
       - name: Checkout repo
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@v4.4.0
         with:
           persist-credentials: false
           fetch-depth: 1
@@ -322,7 +322,7 @@ jobs:
 
       - name: Setup
         id: config
-        uses: ./.github/actions/init
+        uses: $/.github/actions/init
         with:
           cache-enabled: false # OIDC publish job; do not restore poisonable cache state.
           turbo-enabled: false # Remote cache disabled in OIDC publish path.
@@ -350,7 +350,7 @@ jobs:
       - name: Trigger workflows on related repos
         if: steps.publish.outcome == 'success'
         continue-on-error: true
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        uses: actions/github-script@v7.1.0
         with:
           result-encoding: string
           retries: 3
@@ -385,7 +385,7 @@ jobs:
 
       - name: Notify Slack on failure
         if: ${{ always() && steps.publish.outcome == 'failure' }}
-        uses: slackapi/slack-github-action@fcfb566f8b0aab22203f066d80ca1d7e4b5d05b3 # v1.27.1
+        uses: slackapi/slack-github-action@v1.27.1
         with:
           payload: |
             {
@@ -416,7 +416,7 @@ jobs:
 
     steps:
       - name: Limit action to Clerk members
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        uses: actions/github-script@v7.1.0
         with:
           result-encoding: string
           retries: 3
@@ -437,7 +437,7 @@ jobs:
 
       - name: Extract snapshot name
         id: extract-snapshot-name
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        uses: actions/github-script@v7.1.0
         with:
           script: |
             const match = context.payload.comment.body.match(/!snapshot (.*)/)
@@ -449,7 +449,7 @@ jobs:
             core.setOutput('name', name);
 
       - name: Validate PR and dispatch snapshot release
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        uses: actions/github-script@v7.1.0
         env:
           SNAPSHOT_NAME: ${{ steps.extract-snapshot-name.outputs.name }}
         with:
@@ -499,7 +499,7 @@ jobs:
             }
 
       - name: Acknowledge request
-        uses: peter-evans/create-or-update-comment@23ff15729ef2fc348714a3bb66d2f655ca9066f2 # v3.1.0
+        uses: peter-evans/create-or-update-comment@v3.1.0
         with:
           comment-id: ${{ github.event.comment.id }}
           reactions: eyes
@@ -517,7 +517,7 @@ jobs:
 
     steps:
       - name: Validate dispatch inputs
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        uses: actions/github-script@v7.1.0
         env:
           SNAPSHOT_NAME: ${{ inputs.snapshot_name }}
           HEAD_SHA: ${{ inputs.head_sha }}
@@ -532,7 +532,7 @@ jobs:
             }
 
       - name: Checkout repo
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@v4.4.0
         with:
           persist-credentials: false
           fetch-depth: 1
@@ -541,7 +541,7 @@ jobs:
 
       - name: Setup
         id: config
-        uses: ./.github/actions/init
+        uses: $/.github/actions/init
         with:
           cache-enabled: false # OIDC publish job; do not restore poisonable cache state.
           turbo-enabled: false # Remote cache disabled in OIDC publish path.
@@ -570,7 +570,7 @@ jobs:
       - name: Package info
         if: steps.version-packages.outputs.success == '1'
         id: package-info
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        uses: actions/github-script@v7.1.0
         env:
           SNAPSHOT_NAME: ${{ inputs.snapshot_name }}
         with:
@@ -599,14 +599,14 @@ jobs:
 
       - name: Update Comment
         if: steps.version-packages.outputs.success == '1'
-        uses: peter-evans/create-or-update-comment@23ff15729ef2fc348714a3bb66d2f655ca9066f2 # v3.1.0
+        uses: peter-evans/create-or-update-comment@v3.1.0
         with:
           comment-id: ${{ inputs.comment_id }}
           reactions: heart
 
       - name: Minimize previous snapshot comments
         if: steps.version-packages.outputs.success == '1'
-        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
+        uses: actions/github-script@v7.1.0
         env:
           PR_NUMBER: ${{ inputs.pr_number }}
         with:
@@ -637,7 +637,7 @@ jobs:
 
       - name: Create snapshot release comment
         if: steps.version-packages.outputs.success == '1'
-        uses: peter-evans/create-or-update-comment@23ff15729ef2fc348714a3bb66d2f655ca9066f2 # v3.1.0
+        uses: peter-evans/create-or-update-comment@v3.1.0
         with:
           issue-number: ${{ inputs.pr_number }}
           body: |
@@ -666,7 +666,7 @@ jobs:
 
     steps:
       - name: Checkout Repo
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@v4.4.0
         with:
           persist-credentials: false
           fetch-depth: 1
@@ -675,7 +675,7 @@ jobs:
           show-progress: false
 
       - name: Cache node_modules (Node v${{ matrix.version }})
-        uses: ./.github/actions/init
+        uses: $/.github/actions/init
         with:
           cache-enabled: true
           node-version: ${{ matrix.version }}
diff --git a/.github/workflows/validate-renovate-config.yml b/.github/workflows/validate-renovate-config.yml
index b6e5aab0535..cd29b09620b 100644
--- a/.github/workflows/validate-renovate-config.yml
+++ b/.github/workflows/validate-renovate-config.yml
@@ -14,7 +14,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+        uses: actions/checkout@v4.4.0
         with:
           persist-credentials: false