diff --git a/.github/workflows/add-issue-to-project.yml b/.github/workflows/add-issue-to-project.yml
index 7e87f13..fb5c8ac 100644
--- a/.github/workflows/add-issue-to-project.yml
+++ b/.github/workflows/add-issue-to-project.yml
@@ -12,7 +12,7 @@ jobs:
     name: Add issue to project
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd
+      - uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd  # v2.0.0
         with:
           # You can target a repository in a different organization
           # to the issue
diff --git a/.github/workflows/pre-commit-ci.yml b/.github/workflows/pre-commit-ci.yml
index d9f03ab..cbffeda 100644
--- a/.github/workflows/pre-commit-ci.yml
+++ b/.github/workflows/pre-commit-ci.yml
@@ -18,25 +18,25 @@ jobs:
     permissions:
       contents: read
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       with:
         fetch-depth: 0
         persist-credentials: false
     - name: Set up Python
-      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
       with:
         python-version: '3.11'
     - name: Install uv
-      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
     - name: Install dependencies
       run: |
         sudo apt-get update
         uv pip install --system .[dev]
         if [ -f requirements.txt ]; then uv pip install --system -r requirements.txt; fi
-    - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd
+    - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd  # v3.0.1
       with:
         extra_args: --all-files --verbose
       env:
         SKIP: "check-lincc-frameworks-template-version,no-commit-to-branch,check-added-large-files,validate-pyproject,sphinx-build,pytest-check"
-    - uses: pre-commit-ci/lite-action@062bca0919bc9d6e66755cc05074b70c77e111fc
+    - uses: pre-commit-ci/lite-action@062bca0919bc9d6e66755cc05074b70c77e111fc  # v1.2.0
       if: failure() && github.event_name == 'pull_request' && github.event.pull_request.draft == false
\ No newline at end of file
diff --git a/.github/workflows/smoke-test.yml b/.github/workflows/smoke-test.yml
index f39b48a..9eaf488 100644
--- a/.github/workflows/smoke-test.yml
+++ b/.github/workflows/smoke-test.yml
@@ -26,15 +26,15 @@ jobs:
         python-version: ['3.10', '3.11', '3.12', '3.13', '3.14', '3.15']
 
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       with:
         persist-credentials: false
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
       with:
         python-version: ${{ matrix.python-version }}
     - name: Install uv
-      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
     - name: Install dependencies
       run: |
         sudo apt-get update
@@ -50,7 +50,7 @@ jobs:
     - name: Send status to Slack app
       if: ${{ failure() && github.event_name != 'workflow_dispatch' }}
       id: slack
-      uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d
+      uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d  # v4.0.0
       with:
         webhook: ${{ secrets.SLACK_WEBHOOK_URL }}
         webhook-type: webhook-trigger
diff --git a/.github/workflows/testing-and-coverage.yml b/.github/workflows/testing-and-coverage.yml
index 6b3955e..fb10015 100644
--- a/.github/workflows/testing-and-coverage.yml
+++ b/.github/workflows/testing-and-coverage.yml
@@ -22,16 +22,16 @@ jobs:
         python-version: ['3.10', '3.11', '3.12', '3.13', '3.14', '3.15']
 
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       with:
         fetch-depth: 0
         persist-credentials: false
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
       with:
         python-version: ${{ matrix.python-version }}
     - name: Install uv
-      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
     - name: Install dependencies
       run: |
         sudo apt-get update
diff --git a/python-project-template/.github/workflows/pre-commit-ci.yml.jinja b/python-project-template/.github/workflows/pre-commit-ci.yml.jinja
index a6cbfc0..47e522f 100644
--- a/python-project-template/.github/workflows/pre-commit-ci.yml.jinja
+++ b/python-project-template/.github/workflows/pre-commit-ci.yml.jinja
@@ -18,25 +18,25 @@ jobs:
     permissions:
       contents: read
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       with:
         fetch-depth: 0
         persist-credentials: false
     - name: Set up Python
-      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
       with:
         python-version: '{{ py.pref(python_versions) }}'
     - name: Install uv
-      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
     - name: Install dependencies
       run: |
         sudo apt-get update
         uv pip install --system .[dev]
         if [ -f requirements.txt ]; then uv pip install --system -r requirements.txt; fi
-    - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd
+    - uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd  # v3.0.1
       with:
         extra_args: --all-files --verbose
       env:
         SKIP: "check-lincc-frameworks-template-version,no-commit-to-branch,check-added-large-files,validate-pyproject,sphinx-build,pytest-check"
-    - uses: pre-commit-ci/lite-action@062bca0919bc9d6e66755cc05074b70c77e111fc
+    - uses: pre-commit-ci/lite-action@062bca0919bc9d6e66755cc05074b70c77e111fc  # v1.2.0
       if: failure() && github.event_name == 'pull_request' && github.event.pull_request.draft == false
\ No newline at end of file
diff --git a/python-project-template/.github/workflows/{% if contains_code %}publish-to-pypi.yml{% endif %}.jinja b/python-project-template/.github/workflows/{% if contains_code %}publish-to-pypi.yml{% endif %}.jinja
index 9113cd2..8f725a0 100644
--- a/python-project-template/.github/workflows/{% if contains_code %}publish-to-pypi.yml{% endif %}.jinja	
+++ b/python-project-template/.github/workflows/{% if contains_code %}publish-to-pypi.yml{% endif %}.jinja	
@@ -23,11 +23,11 @@ jobs:
     permissions:
       id-token: write
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       with:
         persist-credentials: false
     - name: Set up Python
-      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
       with:
         python-version: '{{ py.pref(python_versions) }}'
     - name: Install dependencies
@@ -37,4 +37,4 @@ jobs:
     - name: Build package
       run: python -m build
     - name: Publish package
-      uses: pypa/gh-action-pypi-publish@release/v1
+      uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
diff --git a/python-project-template/.github/workflows/{% if contains_code %}smoke-test.yml{% endif %}.jinja b/python-project-template/.github/workflows/{% if contains_code %}smoke-test.yml{% endif %}.jinja
index b58bab2..5784d9a 100644
--- a/python-project-template/.github/workflows/{% if contains_code %}smoke-test.yml{% endif %}.jinja	
+++ b/python-project-template/.github/workflows/{% if contains_code %}smoke-test.yml{% endif %}.jinja	
@@ -10,7 +10,7 @@ on:
   # Runs this workflow automatically
   schedule:
     - cron: 45 6 * * *
-    
+
   # Allows you to run this workflow manually from the Actions tab
   workflow_dispatch:
 
@@ -27,15 +27,15 @@ jobs:
         python-version: {{ python_versions }}
 
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       with:
         persist-credentials: false
     - name: Set up Python {% raw %}${{ matrix.python-version }}{% endraw %}
-      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
       with:
         python-version: {% raw %}${{ matrix.python-version }}{% endraw %}
     - name: Install uv
-      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
     - name: Install dependencies
       run: |
         sudo apt-get update
@@ -50,7 +50,7 @@ jobs:
 {%- if 'email' in failure_notification %}
     - name: Send status to author's email      
       if: {% raw %}${{ failure() }} && github.event_name != 'workflow_dispatch' }}{% endraw %} # Only email if the workflow failed and was not manually started. Customize this as necessary.
-      uses: dawidd6/action-send-mail@67ce3558d613188179559c61d3565140cf389968
+      uses: dawidd6/action-send-mail@67ce3558d613188179559c61d3565140cf389968  # v22
       with:
         # Required mail server address if not connection_url:
         server_address: smtp.gmail.com
@@ -87,7 +87,7 @@ jobs:
     - name: Send status to Slack app
       if: ${{ failure() && github.event_name != 'workflow_dispatch' }}
       id: slack
-      uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d
+      uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d  # v4.0.0
       with:
         # For posting a rich message using Block Kit
         webhook: ${{ secrets.SLACK_WEBHOOK_URL }}
diff --git a/python-project-template/.github/workflows/{% if contains_code %}testing-and-coverage.yml{% endif %}.jinja b/python-project-template/.github/workflows/{% if contains_code %}testing-and-coverage.yml{% endif %}.jinja
index 69593d7..f620030 100644
--- a/python-project-template/.github/workflows/{% if contains_code %}testing-and-coverage.yml{% endif %}.jinja	
+++ b/python-project-template/.github/workflows/{% if contains_code %}testing-and-coverage.yml{% endif %}.jinja	
@@ -24,15 +24,15 @@ jobs:
         python-version: {{ python_versions }}
 
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       with:
         persist-credentials: false
     - name: Set up Python {% raw %}${{ matrix.python-version }}{% endraw %}
-      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
       with:
         python-version: {% raw %}${{ matrix.python-version }}{% endraw %}
     - name: Install uv
-      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
     - name: Install dependencies
       run: |
         sudo apt-get update
@@ -42,18 +42,18 @@ jobs:
       run: |
         python -m pytest -o log_cli=true -vv --cov={{package_name}} --cov-report=xml
     - name: Upload coverage report to codecov
-      uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5
+      uses: codecov/codecov-action@303a32d7a59b442fa8d48b6a1cc6825c09c847a5  # v7.1.1
       with:
         token: {% raw %}${{ secrets.CODECOV_TOKEN }}{% endraw %}
 {%- if test_lowest_version != 'none' %}
   test-lowest-versions:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       with:
         persist-credentials: false
     - name: Set up Python {{ py.min(python_versions)  }}
-      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
       with:
         python-version: '{{ py.min(python_versions)  }}'
     - name: Install dependencies
diff --git a/python-project-template/.github/workflows/{% if include_benchmarks %}asv-main.yml{% endif %}.jinja b/python-project-template/.github/workflows/{% if include_benchmarks %}asv-main.yml{% endif %}.jinja
index 63d4ece..2eb356d 100644
--- a/python-project-template/.github/workflows/{% if include_benchmarks %}asv-main.yml{% endif %}.jinja	
+++ b/python-project-template/.github/workflows/{% if include_benchmarks %}asv-main.yml{% endif %}.jinja	
@@ -1,5 +1,5 @@
 {%- raw -%}
-# This workflow will run benchmarks with airspeed velocity (asv), 
+# This workflow will run benchmarks with airspeed velocity (asv),
 # store the new results in the "benchmarks" branch and publish them
 # to a dashboard on GH Pages.
 name: Run ASV benchmarks for main
@@ -32,16 +32,16 @@ jobs:
         working-directory: ${{env.WORKING_DIR}}
     steps:
     - name: Set up Python ${{env.PYTHON_VERSION}}
-      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
       with:
         python-version: ${{env.PYTHON_VERSION}}
     - name: Checkout main branch of the repository
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       with:
         fetch-depth: 0
         persist-credentials: false
     - name: Install dependencies
-      run: pip install asv[virtualenv]==${{env.ASV_VERSION}}
+      run: pip install asv==${{env.ASV_VERSION}}
     - name: Configure git
       run: |
         git config user.name "github-actions[bot]"
@@ -59,7 +59,7 @@ jobs:
     - name: Run ASV for the main branch
       run: asv run ALL --skip-existing --verbose || true
     - name: Submit new results to the "benchmarks" branch
-      uses: JamesIves/github-pages-deploy-action@fa24774553152dd7873cd16ebd8d959b010c5445
+      uses: JamesIves/github-pages-deploy-action@fa24774553152dd7873cd16ebd8d959b010c5445  # v4.9.0
       with:
         branch: benchmarks
         folder: ${{env.WORKING_DIR}}/_results
@@ -69,7 +69,7 @@ jobs:
         asv show
         asv publish
     - name: Deploy to Github pages
-      uses: JamesIves/github-pages-deploy-action@fa24774553152dd7873cd16ebd8d959b010c5445
+      uses: JamesIves/github-pages-deploy-action@fa24774553152dd7873cd16ebd8d959b010c5445  # v4.9.0
       with:
         branch: gh-pages
         folder: ${{env.WORKING_DIR}}/_html
diff --git a/python-project-template/.github/workflows/{% if include_benchmarks %}asv-nightly.yml{% endif %}.jinja b/python-project-template/.github/workflows/{% if include_benchmarks %}asv-nightly.yml{% endif %}.jinja
index e12e954..745b136 100644
--- a/python-project-template/.github/workflows/{% if include_benchmarks %}asv-nightly.yml{% endif %}.jinja	
+++ b/python-project-template/.github/workflows/{% if include_benchmarks %}asv-nightly.yml{% endif %}.jinja	
@@ -30,16 +30,16 @@ jobs:
         working-directory: ${{env.WORKING_DIR}}
     steps:
     - name: Set up Python ${{env.PYTHON_VERSION}}
-      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
       with:
         python-version: ${{env.PYTHON_VERSION}}
     - name: Checkout main branch of the repository
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       with:
         fetch-depth: 0
         persist-credentials: false
     - name: Install dependencies
-      run: pip install asv[virtualenv]==${{env.ASV_VERSION}}
+      run: pip install asv==${{env.ASV_VERSION}}
     - name: Configure git
       run: |
         git config user.name "github-actions[bot]"
@@ -60,7 +60,7 @@ jobs:
         echo "yesterday=$(date -d yesterday +'%Y-%m-%d')" >> $GITHUB_OUTPUT
         echo "today=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
     - name: Use last nightly commit hash from cache
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
       with:
         path: ${{env.WORKING_DIR}}
         key: nightly-results-${{steps.nightly-dates.outputs.yesterday}}
@@ -75,7 +75,7 @@ jobs:
         fi
         echo $CURRENT_HASH > $HASH_FILE
     - name: Update last nightly hash in cache
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
       with:
         path: ${{env.WORKING_DIR}}
         key: nightly-results-${{steps.nightly-dates.outputs.today}}
diff --git a/python-project-template/.github/workflows/{% if include_benchmarks %}asv-pr.yml{% endif %}.jinja b/python-project-template/.github/workflows/{% if include_benchmarks %}asv-pr.yml{% endif %}.jinja
index e7070d3..511785a 100644
--- a/python-project-template/.github/workflows/{% if include_benchmarks %}asv-pr.yml{% endif %}.jinja	
+++ b/python-project-template/.github/workflows/{% if include_benchmarks %}asv-pr.yml{% endif %}.jinja	
@@ -37,11 +37,11 @@ jobs:
         working-directory: ${{env.WORKING_DIR}}
     steps:
     - name: Set up Python ${{env.PYTHON_VERSION}}
-      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
       with:
         python-version: ${{env.PYTHON_VERSION}}
     - name: Checkout PR branch of the repository
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       with:
         fetch-depth: 0
         persist-credentials: false
@@ -49,13 +49,13 @@ jobs:
       run: |
         echo "Workflow Run ID: ${{github.run_id}}"
     - name: Install dependencies
-      run: pip install asv[virtualenv]==${{env.ASV_VERSION}} lf-asv-formatter
+      run: pip install asv==${{env.ASV_VERSION}} lf-asv-formatter
     - name: Make artifacts directory
       run: mkdir -p ${{env.ARTIFACTS_DIR}}
     - name: Save pull request number
       run: echo ${{github.event.pull_request.number}} > ${{env.ARTIFACTS_DIR}}/pr
     - name: Get current job logs URL
-      uses: Tiryoh/gha-jobid-action@be260d8673c9211a84cdcf37794ebd654ba81eef
+      uses: Tiryoh/gha-jobid-action@be260d8673c9211a84cdcf37794ebd654ba81eef  # v1.4.0
       id: jobs
       with:
         github_token: ${{secrets.GITHUB_TOKEN}}
@@ -74,7 +74,7 @@ jobs:
       env:
         STEP_URL: ${{steps.jobs.outputs.html_url}}#step:10:1
     - name: Upload artifacts (PR number and benchmarks output)
-      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9
+      uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9  # v7.0.2
       with:
         name: benchmark-artifacts
         path: ${{env.ARTIFACTS_DIR}}
diff --git a/python-project-template/.github/workflows/{% if include_benchmarks %}publish-benchmarks-pr.yml{% endif %}.jinja b/python-project-template/.github/workflows/{% if include_benchmarks %}publish-benchmarks-pr.yml{% endif %}.jinja
index 50b5d3c..f1aa290 100644
--- a/python-project-template/.github/workflows/{% if include_benchmarks %}publish-benchmarks-pr.yml{% endif %}.jinja	
+++ b/python-project-template/.github/workflows/{% if include_benchmarks %}publish-benchmarks-pr.yml{% endif %}.jinja	
@@ -31,7 +31,7 @@ jobs:
         echo "Conclusion: ${{ github.event.workflow_run.conclusion }}"
         echo "Event: ${{ github.event.workflow_run.event }}"
     - name: Download artifact
-      uses: dawidd6/action-download-artifact@eab87c9830c39eff17e5a6eadb20bfb4bc880477
+      uses: dawidd6/action-download-artifact@eab87c9830c39eff17e5a6eadb20bfb4bc880477  # v27
       with:
         name: benchmark-artifacts
         run_id: ${{ github.event.workflow_run.id }}
@@ -42,14 +42,14 @@ jobs:
         printf "Output:\n$(cat output)"
         printf "pr=$(cat pr)" >> $GITHUB_OUTPUT
     - name: Find benchmarks comment
-      uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad
+      uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad  # v4.0.0
       id: find-comment
       with:
         issue-number: ${{ steps.pr-info.outputs.pr }}
         comment-author: 'github-actions[bot]'
         body-includes: view all benchmarks
     - name: Create or update benchmarks comment
-      uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9
+      uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9  # v5.0.0
       with:
         comment-id: ${{ steps.find-comment.outputs.comment-id }}
         issue-number: ${{ steps.pr-info.outputs.pr }}
diff --git a/python-project-template/.github/workflows/{% if include_docs %}build-documentation.yml{% endif %}.jinja b/python-project-template/.github/workflows/{% if include_docs %}build-documentation.yml{% endif %}.jinja
index efdb0e8..7c6c022 100644
--- a/python-project-template/.github/workflows/{% if include_docs %}build-documentation.yml{% endif %}.jinja	
+++ b/python-project-template/.github/workflows/{% if include_docs %}build-documentation.yml{% endif %}.jinja	
@@ -23,15 +23,15 @@ jobs:
       contents: read
 
     steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
       with:
         persist-credentials: false
     - name: Set up Python {{ py.pref(python_versions) }}
-      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97
+      uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
       with:
         python-version: '{{ py.pref(python_versions) }}'
     - name: Install uv
-      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884
+      uses: astral-sh/setup-uv@1c37ad07a6a961277cf70c0d37d6f313000f5884  # v10.3.0
     - name: Install dependencies
       run: |
         sudo apt-get update
diff --git a/python-project-template/.pre-commit-config.yaml.jinja b/python-project-template/.pre-commit-config.yaml.jinja
index a1ac6d9..86041e3 100644
--- a/python-project-template/.pre-commit-config.yaml.jinja
+++ b/python-project-template/.pre-commit-config.yaml.jinja
@@ -1,10 +1,10 @@
 {%- import 'python-versions.jinja' as py %}
 repos:
     # Compare the local template version to the latest remote template version
-    # This hook should always pass. It will print a message if the local version 
+    # This hook should always pass. It will print a message if the local version
     # is out of date.
   - repo: https://github.com/lincc-frameworks/pre-commit-hooks
-    rev: 439dda8bd784f4aa721851ecec03877df286f6b5
+    rev: 439dda8bd784f4aa721851ecec03877df286f6b5  # v0.2.2
     hooks:
       - id: check-lincc-frameworks-template-version
         name: Check template version
@@ -23,7 +23,7 @@ repos:
         entry: jupyter nbconvert --clear-output
     # Prevents committing directly branches named 'main' and 'master'.
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c
+    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c  # v6.0.0
     hooks:
       - id: no-commit-to-branch
         name: Prevent main branch commits
@@ -34,21 +34,21 @@ repos:
         args: ['--maxkb=500']
     # Verify that pyproject.toml is well formed
   - repo: https://github.com/abravalheri/validate-pyproject
-    rev: 17e12779811926f000bdfa1795f9e3735dd71ac3
+    rev: 17e12779811926f000bdfa1795f9e3735dd71ac3  # v0.26
     hooks:
       - id: validate-pyproject
         name: Validate pyproject.toml
         description: Verify that pyproject.toml adheres to the established schema.
     # Verify that GitHub workflows are well formed
   - repo: https://github.com/python-jsonschema/check-jsonschema
-    rev: 0494aa7fa1314e98913a41227d8f0a515b2c1049
+    rev: 0494aa7fa1314e98913a41227d8f0a515b2c1049  # v0.38.2
     hooks:
       - id: check-github-workflows
         args: ["--verbose"]
 {%- if 'isort' in enforce_style %}
     # Automatically sort the imports used in .py files
   - repo: https://github.com/pycqa/isort
-    rev: 9f905615631c545f5aea2516508109350d1d2f7d
+    rev: 9f905615631c545f5aea2516508109350d1d2f7d  # v9.0.2
     hooks:
       - id: isort
         name: Run isort
@@ -90,7 +90,7 @@ repos:
 {%- if 'black' in enforce_style %}
     # Analyze the code style and report code that doesn't adhere.
   - repo: https://github.com/psf/black
-    rev: 258e7dbf348bc23cb70b8cdf693481c04634ebcc
+    rev: 258e7dbf348bc23cb70b8cdf693481c04634ebcc  # v26.10.1
     hooks:
       - id: black-jupyter
         name: Format code using black
@@ -106,7 +106,7 @@ repos:
 {%- if 'ruff_lint' in enforce_style %}
   - repo: https://github.com/astral-sh/ruff-pre-commit
     # Ruff version.
-    rev: 44b5042edab9382aba712eed4f9c7bab7a3d6a3e
+    rev: 44b5042edab9382aba712eed4f9c7bab7a3d6a3e  # v0.17.0
     hooks:
       - id: ruff
         name: Lint code using ruff; sort and organize imports 
@@ -116,7 +116,7 @@ repos:
 {%- if 'ruff_format' in enforce_style %}
   - repo: https://github.com/astral-sh/ruff-pre-commit
     # Ruff version.
-    rev: 44b5042edab9382aba712eed4f9c7bab7a3d6a3e
+    rev: 44b5042edab9382aba712eed4f9c7bab7a3d6a3e  # v0.17.0
     hooks:
       - id: ruff-format
         name: Format code using ruff
@@ -125,7 +125,7 @@ repos:
 {%- if mypy_type_checking != 'none' %}
     # Analyze type hints and report errors.
   - repo: https://github.com/pre-commit/mirrors-mypy
-    rev: 2834ec6639549dd6796205c8f011dedcd587288b
+    rev: 2834ec6639549dd6796205c8f011dedcd587288b  # v2.4.0
     hooks:
       - id: mypy
         name: mypy (python files in src/ and tests/)
@@ -144,7 +144,7 @@ repos:
 {%- endif %}
 {%- if include_docs and include_notebooks %}
   - repo: https://github.com/lincc-frameworks/pre-commit-hooks
-    rev: 439dda8bd784f4aa721851ecec03877df286f6b5
+    rev: 439dda8bd784f4aa721851ecec03877df286f6b5  # v0.2.2
     hooks:
       - id: pre-executed-nb-never-execute
         name: Check pre-executed notebooks
diff --git a/python-project-template/.setup_dev.sh b/python-project-template/.setup_dev.sh
index 5286e41..c09be48 100755
--- a/python-project-template/.setup_dev.sh
+++ b/python-project-template/.setup_dev.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 
-# Bash Unofficial strict mode (http://redsymbol.net/articles/unofficial-bash-strict-mode/) 
+# Bash Unofficial strict mode (http://redsymbol.net/articles/unofficial-bash-strict-mode/)
 # and (https://disconnected.systems/blog/another-bash-strict-mode/)
 set -o nounset # Any uninitialized variable is an error
 set -o errexit # Exit the script on the failure of any command to execute without error