diff --git a/.github/workflows/docs-check.yml b/.github/workflows/docs-check.yml
new file mode 100644
index 00000000..cb6b841b
--- /dev/null
+++ b/.github/workflows/docs-check.yml
@@ -0,0 +1,39 @@
+name: Docs Check
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - 'internal/readme/**'
+      - 'README.md'
+      - 'internal/docs/**'
+      - 'docs/**'
+
+permissions:
+  contents: read
+
+jobs:
+  docs-check:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set up Go
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5
+      - name: Check out code
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
+      - name: Check docs are up-to-date
+        run: |
+          go generate ./...
+          if [ -n "$(git status --porcelain)" ]; then
+            echo "ERROR: docs are not up-to-date!"
+            echo ""
+            echo "The docs differ from what would be generated by `go generate ./...`."
+            echo "Please update internal/**/*.src.md instead of directly editing README.md or docs/ files,"
+            echo "then run `go generate ./...` to regenerate docs."
+            echo ""
+            echo "Changes:"
+            git status --porcelain
+            echo ""
+            echo "Diff:"
+            git diff
+            exit 1
+          fi
+          echo "Docs are up-to-date."
diff --git a/.github/workflows/readme-check.yml b/.github/workflows/readme-check.yml
deleted file mode 100644
index 8709be11..00000000
--- a/.github/workflows/readme-check.yml
+++ /dev/null
@@ -1,39 +0,0 @@
-name: README Check
-on:
-  workflow_dispatch:
-  pull_request:
-    paths:
-      - 'internal/readme/**'
-      - 'README.md'
-      - 'internal/docs/**'
-      - 'docs/**'
-
-permissions:
-  contents: read
-
-jobs:
-  readme-check:
-    runs-on: ubuntu-latest
-    steps:
-    - name: Set up Go
-      uses: actions/setup-go@v5
-    - name: Check out code
-      uses: actions/checkout@v4
-    - name: Check docs is up-to-date
-      run: |
-        go generate ./...
-        if [ -n "$(git status --porcelain)" ]; then
-          echo "ERROR: docs are not up-to-date!"
-          echo ""
-          echo "The docs differ from what would be generated by `go generate ./...`."
-          echo "Please update internal/**/*.src.md instead of directly editing README.md or docs/ files,"
-          echo "then run `go generate ./...` to regenerate docs."
-          echo ""
-          echo "Changes:"
-          git status --porcelain
-          echo ""
-          echo "Diff:"
-          git diff
-          exit 1
-        fi
-        echo "Docs are up-to-date."
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 9ad50c1d..03662463 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -14,9 +14,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5
         with:
           go-version: "^1.23"
       - name: Check formatting
@@ -31,7 +31,7 @@ jobs:
       - name: Run Go vet
         run: go vet ./...
       - name: Run staticcheck
-        uses: dominikh/staticcheck-action@v1
+        uses: dominikh/staticcheck-action@024238d2898c874f26d723e7d0ff4308c35589a2 # v1
         with:
           version: "latest"
 
@@ -42,9 +42,9 @@ jobs:
         go: ["1.23", "1.24", "1.25"]
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5
         with:
           go-version: ${{ matrix.go }}
       - name: Test
@@ -54,9 +54,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@08eba0b27e820071cde6df949e0beb9ba4906955 # v4
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@d35c59abb061a4a6fb18e82ac0862c26744d6ab5 # v5
         with:
           go-version: "1.24"
       - name: Test with -race