diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index f602321..354975d 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -36,3 +36,5 @@ updates:
         update-types:
           - "minor"
           - "patch"
+    cooldown:
+      default-days: 7
diff --git a/.github/workflows/benchmark.yml b/.github/workflows/benchmark.yml
index 0b764cd..bc8a5f2 100644
--- a/.github/workflows/benchmark.yml
+++ b/.github/workflows/benchmark.yml
@@ -28,18 +28,20 @@ jobs:
       deployments: write
     steps:
       - name: Checkout code
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Rust
-        uses: actions-rust-lang/setup-rust-toolchain@v2
+        uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
 
       - name: Run benchmark
         # We use --output-format bencher to make the output compatible with the
         # github-action-benchmark action's 'cargo' tool parser.
+        env:
+          CRITERION_HOME: ${{ runner.temp }}/criterion
         run: cargo bench --bench bench_main --all-features -- --output-format bencher | tee output.txt
 
       - name: Store benchmark result
-        uses: benchmark-action/github-action-benchmark@v1
+        uses: benchmark-action/github-action-benchmark@52576c92bccf6ac60c8223ec7eb2565637cae9ba # v1.22.1
         with:
           name: RulesXP Benchmark
           tool: 'cargo'
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 3563e82..e54a8a7 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -40,7 +40,7 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Resolve toolchain
       id: resolve
@@ -59,7 +59,7 @@ jobs:
         fi
 
     - name: Install Rust
-      uses: actions-rust-lang/setup-rust-toolchain@v2
+      uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
       with:
         toolchain: ${{ steps.resolve.outputs.toolchain }}
         components: ${{ steps.resolve.outputs.should-run-full-checks == 'true' && 'clippy' || '' }}
@@ -87,15 +87,15 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Install Rust
-      uses: actions-rust-lang/setup-rust-toolchain@v2
+      uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
       with:
         components: llvm-tools-preview
 
     - name: Install cargo-llvm-cov
-      uses: taiki-e/install-action@v2
+      uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375 # v2.87.12
       with:
         tool: cargo-llvm-cov
 
@@ -105,7 +105,7 @@ jobs:
         cargo llvm-cov --all-features --workspace --lcov --output-path lcov.info --no-run
 
     - name: Upload coverage HTML
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: coverage-report
         path: coverage-html/
@@ -113,7 +113,7 @@ jobs:
 
     - name: Upload to Codecov
       if: env.CODECOV_TOKEN != ''
-      uses: codecov/codecov-action@v7
+      uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
       with:
         files: lcov.info
         fail_ci_if_error: true
@@ -127,10 +127,10 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Install Rust
-      uses: actions-rust-lang/setup-rust-toolchain@v2
+      uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
       with:
         components: rustfmt
 
@@ -146,10 +146,10 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Install Rust
-      uses: actions-rust-lang/setup-rust-toolchain@v2
+      uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
 
     - name: Build documentation
       run: cargo doc --all-features --no-deps
@@ -163,10 +163,10 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Install Rust nightly
-      uses: actions-rust-lang/setup-rust-toolchain@v2
+      uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
       with:
         toolchain: nightly
 
@@ -183,10 +183,10 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Install cargo-audit
-      uses: taiki-e/install-action@v2
+      uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375 # v2.87.12
       with:
         tool: cargo-audit
 
@@ -200,15 +200,15 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Install Rust nightly
-      uses: actions-rust-lang/setup-rust-toolchain@v2
+      uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
       with:
         toolchain: nightly
 
     - name: Install cargo-hack and cargo-minimal-versions
-      uses: taiki-e/install-action@v2
+      uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375 # v2.87.12
       with:
         tool: cargo-hack,cargo-minimal-versions
 
@@ -222,10 +222,10 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Install typos
-      uses: taiki-e/install-action@v2
+      uses: taiki-e/install-action@3f74d7c16a4242f1c95561e98edc25d36adb4375 # v2.87.12
       with:
         tool: typos-cli
 
@@ -239,10 +239,10 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Run actionlint
-      uses: raven-actions/actionlint@v2
+      uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2.2.0
 
   ci-success:
     name: CI Success
diff --git a/.github/workflows/cross-platform.yml b/.github/workflows/cross-platform.yml
index 6c195e5..979c180 100644
--- a/.github/workflows/cross-platform.yml
+++ b/.github/workflows/cross-platform.yml
@@ -32,10 +32,10 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Install Rust
-      uses: actions-rust-lang/setup-rust-toolchain@v2
+      uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
 
     - name: Run tests
       run: cargo test --all-features --verbose
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index 4968fe7..eb07440 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -31,14 +31,14 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        target: ['eval_sexpr', 'eval_jsonlogic']
+        target: ['eval-sexpr', 'eval-jsonlogic']
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Install Rust nightly
-      uses: actions-rust-lang/setup-rust-toolchain@v2
+      uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
       with:
         toolchain: nightly
 
@@ -50,7 +50,7 @@ jobs:
     # - Restore key uses prefix match to find the most recent cache from any prior run
     # - Daily runs ensure we always have a recent corpus to build on
     - name: Restore corpus cache
-      uses: actions/cache@v6
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
       with:
         path: fuzz/corpus/${{ matrix.target }}
         key: fuzz-corpus-${{ matrix.target }}-${{ github.run_id }}
@@ -75,14 +75,14 @@ jobs:
 
     - name: Upload crash artifacts
       if: steps.check_crashes.outputs.crashes_found == 'true'
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: fuzz-crashes-${{ matrix.target }}
         path: fuzz/artifacts/${{ matrix.target }}/
 
     - name: Upload corpus
       if: always()
-      uses: actions/upload-artifact@v7
+      uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
       with:
         name: fuzz-corpus-${{ matrix.target }}
         path: fuzz/corpus/${{ matrix.target }}/
@@ -90,7 +90,7 @@ jobs:
 
     - name: Create issue for crashes
       if: steps.check_crashes.outputs.crashes_found == 'true'
-      uses: actions/github-script@v9
+      uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
       with:
         script: |
           const fs = require('fs');
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index d54bfb4..4f131a8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -24,7 +24,7 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         # The ancestry check needs enough history to prove the tag commit
         # is reachable from origin/main.
@@ -40,7 +40,7 @@ jobs:
         fi
 
     - name: Install Rust
-      uses: actions-rust-lang/setup-rust-toolchain@v2
+      uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
       with:
         toolchain: stable
         rustflags: ''
@@ -58,7 +58,7 @@ jobs:
         echo "Version check passed: $CARGO_VERSION"
 
     - name: Authenticate with crates.io
-      uses: rust-lang/crates-io-auth-action@v1
+      uses: rust-lang/crates-io-auth-action@c6f97d42243bad5fab37ca0427f495c86d5b1a18 # v1.0.5
       id: auth
 
     - name: Publish to crates.io
@@ -80,7 +80,7 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Get tag name
       id: tag_name
@@ -120,10 +120,10 @@ jobs:
 
     steps:
     - name: Checkout code
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
     - name: Install Rust
-      uses: actions-rust-lang/setup-rust-toolchain@v2
+      uses: actions-rust-lang/setup-rust-toolchain@ecabd13d1c56bd1345c230e542e9144811ad706f # v2.0.0
       with:
         toolchain: stable
         target: ${{ matrix.target }}
diff --git a/CHANGELOG.md b/CHANGELOG.md
index e26c6bc..0f32293 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -10,7 +10,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Changed
 
 - CI enforces production-code-only MSRV, stricter doc and workflow checks, least-privilege permissions & job timeouts
-- Release flow uses SHA-pinning-friendly Rust installation, locked publication, pre-publish tag validation, and retry-safe GH releases
+- CI uses SHA-pinned actions, locked publication, pre-publish tag validation, and retry-safe GH releases
 
 ## 0.3.1
 
diff --git a/fuzz/Cargo.toml b/fuzz/Cargo.toml
index 70c826c..616c54b 100644
--- a/fuzz/Cargo.toml
+++ b/fuzz/Cargo.toml
@@ -14,14 +14,14 @@ path = ".."
 features = ["scheme", "jsonlogic"]
 
 [[bin]]
-name = "eval_sexpr"
+name = "eval-sexpr"
 path = "fuzz_targets/eval_sexpr.rs"
 test = false
 doc = false
 bench = false
 
 [[bin]]
-name = "eval_jsonlogic"
+name = "eval-jsonlogic"
 path = "fuzz_targets/eval_jsonlogic.rs"
 test = false
 doc = false