diff --git a/.github/workflows/PullRequestClosed.yml b/.github/workflows/PullRequestClosed.yml
index e410590..4f5dbf1 100644
--- a/.github/workflows/PullRequestClosed.yml
+++ b/.github/workflows/PullRequestClosed.yml
@@ -17,6 +17,9 @@ jobs:
     if: |
       github.event.pull_request.head.repo.full_name == github.repository
     steps:
+      - uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          egress-policy: audit
       - id: secrets
         uses: SonarSource/vault-action-wrapper@545e7cfbb5528e7009a1edcc83e073898d292627 # 3.2.0
         with:
diff --git a/.github/workflows/PullRequestCreated.yml b/.github/workflows/PullRequestCreated.yml
index 54f6373..364ae1a 100644
--- a/.github/workflows/PullRequestCreated.yml
+++ b/.github/workflows/PullRequestCreated.yml
@@ -16,6 +16,9 @@ jobs:
     if: |
       github.event.pull_request.head.repo.full_name == github.repository
     steps:
+      - uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          egress-policy: audit
       - id: secrets
         uses: SonarSource/vault-action-wrapper@545e7cfbb5528e7009a1edcc83e073898d292627 # 3.2.0
         with:
diff --git a/.github/workflows/RequestReview.yml b/.github/workflows/RequestReview.yml
index 3f8b728..6d8eef7 100644
--- a/.github/workflows/RequestReview.yml
+++ b/.github/workflows/RequestReview.yml
@@ -16,6 +16,9 @@ jobs:
     if: |
       github.event.pull_request.head.repo.full_name == github.repository
     steps:
+      - uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          egress-policy: audit
       - id: secrets
         uses: SonarSource/vault-action-wrapper@545e7cfbb5528e7009a1edcc83e073898d292627 # 3.2.0
         with:
diff --git a/.github/workflows/SubmitReview.yml b/.github/workflows/SubmitReview.yml
index bd08402..52c4cdd 100644
--- a/.github/workflows/SubmitReview.yml
+++ b/.github/workflows/SubmitReview.yml
@@ -19,6 +19,9 @@ jobs:
       && (github.event.review.state == 'changes_requested'
           || github.event.review.state == 'approved')
     steps:
+      - uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          egress-policy: audit
       - id: secrets
         uses: SonarSource/vault-action-wrapper@545e7cfbb5528e7009a1edcc83e073898d292627 # 3.2.0
         with:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index b8d5e14..655b697 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -20,6 +20,9 @@ jobs:
       contents: write
       attestations: write
     steps:
+      - uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          egress-policy: audit
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - uses: SonarSource/ci-github-actions/build-poetry@master # dogfood
         with:
@@ -39,6 +42,9 @@ jobs:
       id-token: write
       contents: write
     steps:
+      - uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          egress-policy: audit
       - uses: SonarSource/ci-github-actions/promote@master # dogfood
         with:
           promote-pull-request: true
diff --git a/.github/workflows/pr-cleanup.yml b/.github/workflows/pr-cleanup.yml
index 04c2308..0d5ab7d 100644
--- a/.github/workflows/pr-cleanup.yml
+++ b/.github/workflows/pr-cleanup.yml
@@ -10,4 +10,7 @@ jobs:
     permissions:
       actions: write
     steps:
+      - uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          egress-policy: audit
       - uses: SonarSource/ci-github-actions/pr_cleanup@master # dogfood
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 3ecee82..07e577c 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -7,6 +7,9 @@ jobs:
     name: "pre-commit"
     runs-on: github-ubuntu-latest-s
     steps:
+      - uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          egress-policy: audit
       - uses: jdx/mise-action@5ac50f778e26fac95da98d50503682459e86d566 # v3.2.0
         with:
           version: 2025.12.13
diff --git a/.github/workflows/slack_notify.yml b/.github/workflows/slack_notify.yml
index 19746f2..3324ca7 100644
--- a/.github/workflows/slack_notify.yml
+++ b/.github/workflows/slack_notify.yml
@@ -12,6 +12,9 @@ jobs:
   notify:
     runs-on: github-ubuntu-latest-s
     steps:
+      - uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          egress-policy: audit
       - name: Send Slack Notification
         env:
           GITHUB_TOKEN: ${{ github.token }}
diff --git a/.github/workflows/unified-dogfooding.yml b/.github/workflows/unified-dogfooding.yml
index 756a9e2..4832692 100644
--- a/.github/workflows/unified-dogfooding.yml
+++ b/.github/workflows/unified-dogfooding.yml
@@ -13,6 +13,9 @@ jobs:
       id-token: write
       contents: write
     steps:
+      - uses: step-security/harden-runner@8d3c67de8e2fe68ef647c8db1e6a09f647780f40 # v2.19.0
+        with:
+          egress-policy: audit
       - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - uses: SonarSource/ci-github-actions/build-poetry@master # dogfood
         with: