diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 000000000..9a7d4acb6
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,18 @@
+# yaml-language-server: $schema=https://www.schemastore.org/dependabot-2.0.json
+# See GitHub's documentation for more information on this file:
+# https://docs.github.com/en/code-security/dependabot/working-with-dependabot/dependabot-options-reference
+---
+version: 2
+
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: ci
+      include: scope
+    groups:
+      all:
+        patterns:
+          - "*"
diff --git a/.github/workflows/close-stale-prs.yml b/.github/workflows/close-stale-prs.yml
index 68fa579ad..c9a810a7b 100644
--- a/.github/workflows/close-stale-prs.yml
+++ b/.github/workflows/close-stale-prs.yml
@@ -2,26 +2,27 @@
 #
 # For more information, see:
 # https://github.com/actions/stale
+# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
+---
 name: Close stale pull requests
 
 on:
   schedule:
-  - cron: '0 18 * * *' # Run the workflow every day at 6PM UTC (10AM PST).
+    - cron: "0 18 * * *" # Run the workflow every day at 6PM UTC (10AM PST).
 
 jobs:
   stale:
-
     runs-on: ubuntu-latest
     permissions:
       pull-requests: write
 
     steps:
-    - uses: actions/stale@v9
-      with:
-        repo-token: ${{ secrets.GITHUB_TOKEN }}
-        stale-pr-message: 'This pull request has been automatically marked as stale because it has been inactive for 90 days. Remove stale label or comment or this PR will be closed in 7 days.'
-        stale-pr-label: 'stale'
-        days-before-pr-stale: 90 # 3 months
-        days-before-pr-close: 7
-        days-before-issue-stale: -1
-        days-before-issue-close: -1
\ No newline at end of file
+      - uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # v10.1.0
+        with:
+          repo-token: ${{ github.token }}
+          stale-pr-message: This pull request has been automatically marked as stale because it has been inactive for 90 days. Remove stale label or comment or this PR will be closed in 7 days.
+          stale-pr-label: stale
+          days-before-pr-stale: 90 # 3 months
+          days-before-pr-close: 7
+          days-before-issue-stale: -1
+          days-before-issue-close: -1
diff --git a/.github/workflows/issues.yml b/.github/workflows/issues.yml
index e4a5b680b..434c628a8 100644
--- a/.github/workflows/issues.yml
+++ b/.github/workflows/issues.yml
@@ -1,3 +1,5 @@
+# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
+---
 name: Sync issue to Azure DevOps work item
 
 on:
@@ -23,27 +25,31 @@ jobs:
       # Auth using Azure Service Principals was added as a part of v2.3
       # reference: https://github.com/danhellem/github-actions-issue-to-work-item/pull/143
       - name: Login to Azure
-        uses: azure/login@v2
+        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
         with:
           client-id: ${{ vars.AZURE_SP_DEVOPS_SYNC_CLIENT_ID }}
           tenant-id: ${{ vars.AZURE_SP_DEVOPS_SYNC_TENANT_ID }}
           allow-no-subscriptions: true
+
       - name: Get Azure DevOps token
         id: get_ado_token
-        run:
+        run: |
           # The resource ID for Azure DevOps is always 499b84ac-1321-427f-aa17-267ca6975798
           # https://learn.microsoft.com/azure/devops/integrate/get-started/authentication/service-principal-managed-identity
-          echo "ADO_TOKEN=$(az account get-access-token --resource 499b84ac-1321-427f-aa17-267ca6975798 --query "accessToken" --output tsv)" >> $GITHUB_ENV
+          ADO_TOKEN=$(az account get-access-token --resource 499b84ac-1321-427f-aa17-267ca6975798 --query "accessToken" --output tsv)
+          echo "::add-mask::$ADO_TOKEN"
+          echo "ADO_TOKEN=$ADO_TOKEN" >> $GITHUB_ENV
+
       - name: Sync issue to Azure DevOps
-        uses: danhellem/github-actions-issue-to-work-item@v2.3
+        uses: danhellem/github-actions-issue-to-work-item@8d0ead9b49a65aa66dac6949b1ff149d7ef8b4de # v2.5
         env:
           ado_token: ${{ env.ADO_TOKEN }}
-          github_token: '${{ secrets.GH_RAD_CI_BOT_PAT }}'
-          ado_organization: 'azure-octo'
-          ado_project: 'Incubations'
+          github_token: ${{ secrets.GH_RAD_CI_BOT_PAT }}
+          ado_organization: azure-octo
+          ado_project: Incubations
           ado_area_path: "Incubations\\Radius"
           ado_iteration_path: "Incubations\\Radius"
-          ado_new_state: 'New'
-          ado_active_state: 'Active'
-          ado_close_state: 'Closed'
-          ado_wit: 'GitHub Issue'
+          ado_new_state: New
+          ado_active_state: Active
+          ado_close_state: Closed
+          ado_wit: GitHub Issue
diff --git a/.github/workflows/pr-checks.yaml b/.github/workflows/pr-checks.yaml
index 9013e3b55..fbed607ca 100644
--- a/.github/workflows/pr-checks.yaml
+++ b/.github/workflows/pr-checks.yaml
@@ -1,3 +1,5 @@
+# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
+---
 name: PR Checks
 
 on:
@@ -10,8 +12,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check for do-not-merge label
-        uses: mheap/github-action-required-labels@v5
+        uses: mheap/github-action-required-labels@8afbe8ae6ab7647d0c9f0cfa7c2f939650d22509 # v5.5.1
         with:
-            labels: "do-not-merge"
-            mode: exactly
-            count: 0
+          labels: do-not-merge
+          mode: exactly
+          count: 0
diff --git a/.github/workflows/redirect.yml b/.github/workflows/redirect.yml
index 0390de50b..d0691e89f 100644
--- a/.github/workflows/redirect.yml
+++ b/.github/workflows/redirect.yml
@@ -1,3 +1,5 @@
+# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
+---
 name: Radius Redirect
 
 on:
@@ -6,16 +8,16 @@ on:
     branches:
       - edge
       - v*.*
-    paths: 
-      - 'redirect/**'
-      - '.github/workflows/redirect.yml'
+    paths:
+      - "redirect/**"
+      - ".github/workflows/redirect.yml"
   pull_request:
     branches:
       - edge
       - v*.*
-    paths: 
-      - 'redirect/**'
-      - '.github/workflows/redirect.yml'
+    paths:
+      - "redirect/**"
+      - ".github/workflows/redirect.yml"
 
 jobs:
   deploy-website:
@@ -23,17 +25,19 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           submodules: false
+
       - name: Deploy staging site
-        uses: Azure/static-web-apps-deploy@v1
+        uses: Azure/static-web-apps-deploy@4d27395796ac319302594769cfe812bd207490b1 # v1
         with:
           azure_static_web_apps_api_token: ${{ secrets.SWA_REDIRECT_TOKEN }}
-          action: "upload"
-          app_location: "redirect/src"
+          action: upload
+          app_location: redirect/src
           skip_api_build: true
           skip_app_build: true
+          skip_deploy_on_missing_secrets: true
 
   close_pr_site:
     name: Close PR Staging Site
@@ -42,7 +46,9 @@ jobs:
     steps:
       - name: Close Pull Request
         id: closepullrequest
-        uses: Azure/static-web-apps-deploy@v1
+        uses: Azure/static-web-apps-deploy@4d27395796ac319302594769cfe812bd207490b1 # v1
         with:
           azure_static_web_apps_api_token: ${{ secrets.SWA_REDIRECT_TOKEN }}
-          action: "close"
+          action: close
+          app_location: redirect/src
+          skip_deploy_on_missing_secrets: true
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 28e634b41..35ede98d4 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -1,44 +1,51 @@
+# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
+---
 name: Release docs
 
 on:
   workflow_dispatch:
     inputs:
       version:
-        description: 'Radius version number to use (e.g. 0.22.0, 0.23.0-rc1)'
+        description: "Radius version number to use (e.g. 0.22.0, 0.23.0-rc1)"
         required: true
-        default: ''
+        default: ""
         type: string
 
 env:
   GITHUB_TOKEN: ${{ secrets.GH_RAD_CI_BOT_PAT }}
-  GITHUB_EMAIL: 'radiuscoreteam@service.microsoft.com'
-  GITHUB_USER: 'Radius CI Bot'
+  GITHUB_EMAIL: radiuscoreteam@service.microsoft.com
+  GITHUB_USER: Radius CI Bot
 
 jobs:
   release-docs:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           token: ${{ secrets.GH_RAD_CI_BOT_PAT }}
           ref: edge
           path: docs
+
       - name: Configure git
         run: |
           git config --global user.email "${{ env.GITHUB_EMAIL }}"
           git config --global user.name "${{ env.GITHUB_USER }}"
+
       - name: Ensure inputs.version is valid semver
         run: |
           python ./docs/.github/scripts/validate_semver.py ${{ inputs.version }}
+
       - name: Parse release channel
         id: parse_release_channel
         run: |
           # CHANNEL is the major and minor version of the VERSION_NUMBER (e.g. 0.1)
           CHANNEL="$(echo ${{ inputs.version }} | cut -d '.' -f 1,2)"
           echo "channel=$CHANNEL" >> $GITHUB_OUTPUT
+
       - name: Release docs
         run: |
           ./docs/.github/scripts/release-docs.sh ${{ inputs.version }}
+
       - name: Change the default branch
         run: |
           gh api \
diff --git a/.github/workflows/spellcheck.yaml b/.github/workflows/spellcheck.yaml
index 6b3820d12..a5dc61a59 100644
--- a/.github/workflows/spellcheck.yaml
+++ b/.github/workflows/spellcheck.yaml
@@ -1,3 +1,5 @@
+# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
+---
 name: Spellcheck
 
 on:
@@ -13,7 +15,7 @@ on:
       - edge
 
 env:
-  ACTION_LINK: '${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}'
+  ACTION_LINK: "${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}"
 
 concurrency:
   group: spellcheck-${{ github.ref }}-${{ github.event.pull_request.number || github.sha }}
@@ -23,37 +25,42 @@ jobs:
     name: Spellcheck
     runs-on: ubuntu-latest
     steps:
-    - name: Checkout docs
-      uses: actions/checkout@v4
-    - name: Spellcheck
-      uses: rojopolis/spellcheck-github-actions@0.36.0
-      with:
-        config_path: .github/config/.pyspelling.yml
-    - name: Post GitHub workkflow output on failure
-      if: failure()
-      run: |
-        echo "## :x: Spellcheck Failed" >> $GITHUB_STEP_SUMMARY
-        echo "There are spelling errors in your PR. Visit [the workflow output](${{ env.ACTION_LINK }}) to see what words are failing." >> $GITHUB_STEP_SUMMARY
-        echo "### Adding new words" >> $GITHUB_STEP_SUMMARY
-        echo "If you are adding a new custom word refer to the [docs guide](https://docs.radapp.io/contributing/docs/#spelling)" >> $GITHUB_STEP_SUMMARY
-    - name: Post GitHub workflow output on success
-      run: |
-        echo "## :white_check_mark: Spellcheck Passed" >> $GITHUB_STEP_SUMMARY
-        echo "There are no spelling errors in your PR." >> $GITHUB_STEP_SUMMARY
-    - name: Post GitHub comment on failure
-      if: failure()
-      uses: marocchino/sticky-pull-request-comment@v2
-      with:
-        header: spellcheck
-        recreate: true
-        message: |
-          ## :x: Spellcheck Failed
-          There are spelling errors in your PR. Visit [the workflow output](${{ env.ACTION_LINK }}) to see what words are failing.
-          ### Adding new words
-          If you are adding a new custom word refer to the [docs guide](https://docs.radapp.io/contributing/docs/#spelling)
-    - name: Clear GitHub comment on success
-      uses: marocchino/sticky-pull-request-comment@v2
-      continue-on-error: true
-      with:
-        header: spellcheck
-        delete: true
+      - name: Checkout docs
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+
+      - name: Spellcheck
+        uses: rojopolis/spellcheck-github-actions@6f2326b663e2dbab920da0fc4144b9f3202434ba # 0.54.0
+        with:
+          config_path: .github/config/.pyspelling.yml
+
+      - name: Post GitHub workkflow output on failure
+        if: failure()
+        run: |
+          echo "## :x: Spellcheck Failed" >> $GITHUB_STEP_SUMMARY
+          echo "There are spelling errors in your PR. Visit [the workflow output](${{ env.ACTION_LINK }}) to see what words are failing." >> $GITHUB_STEP_SUMMARY
+          echo "### Adding new words" >> $GITHUB_STEP_SUMMARY
+          echo "If you are adding a new custom word refer to the [docs guide](https://docs.radapp.io/contributing/docs/#spelling)" >> $GITHUB_STEP_SUMMARY
+
+      - name: Post GitHub workflow output on success
+        run: |
+          echo "## :white_check_mark: Spellcheck Passed" >> $GITHUB_STEP_SUMMARY
+          echo "There are no spelling errors in your PR." >> $GITHUB_STEP_SUMMARY
+
+      - name: Post GitHub comment on failure
+        if: failure()
+        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
+        with:
+          header: spellcheck
+          recreate: true
+          message: |
+            ## :x: Spellcheck Failed
+            There are spelling errors in your PR. Visit [the workflow output](${{ env.ACTION_LINK }}) to see what words are failing.
+            ### Adding new words
+            If you are adding a new custom word refer to the [docs guide](https://docs.radapp.io/contributing/docs/#spelling)
+
+      - name: Clear GitHub comment on success
+        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
+        continue-on-error: true
+        with:
+          header: spellcheck
+          delete: true
diff --git a/.github/workflows/upmerge.yaml b/.github/workflows/upmerge.yaml
index 9c7ecd733..21779d36a 100644
--- a/.github/workflows/upmerge.yaml
+++ b/.github/workflows/upmerge.yaml
@@ -1,6 +1,6 @@
 # This workflow automates the process of upmerging changes from the current release branch to the edge branch.
 # During the course of a release, the release branch is the default branch so that PRs can be immediately
-# brought into the release without waiting for a new release. This workflow merges those changes into 
+# brought into the release without waiting for a new release. This workflow merges those changes into
 # the edge branch so that edge can be used as the basis for the next release branch.
 #
 # This workflow assumes that it is being triggered from the current release branch, but it could be triggered from
@@ -22,6 +22,8 @@
 # 2. Changes from branch v0.36 are merged into branch upmerge/2024-07-31-98b9.
 # 3. A PR is created from branch upmerge/2024-07-31-98b9 --> edge. The workflow finishes and reports success.
 
+# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
+---
 name: Upmerge docs to edge
 
 on:
@@ -32,18 +34,17 @@ jobs:
     name: Upmerge docs to edge
     runs-on: ubuntu-latest
     steps:
-
       # Checkout the edge branch
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           ref: edge
           # https://github.com/actions/checkout/issues/125#issuecomment-570254411
           fetch-depth: 0
           persist-credentials: false
-      
+
       - name: Configure git
         env:
-            GH_TOKEN: ${{ secrets.GH_RAD_CI_BOT_PAT }}
+          GH_TOKEN: ${{ secrets.GH_RAD_CI_BOT_PAT }}
         run: |
           git config --global user.email "radiuscoreteam@service.microsoft.com"
           git config --global user.name "Radius CI Bot"
@@ -57,7 +58,7 @@ jobs:
           export BRANCH_NAME=upmerge/$DATE-$RAND
           echo "BRANCH_NAME=$BRANCH_NAME" >> $GITHUB_ENV
           git checkout -b $BRANCH_NAME
-      
+
       # Merge changes from the github.ref branch, i.e., the branch from which the workflow is triggered. That
       # branch is assumed to be the current release branch, but could be any branch.
       # If there are no changes, stop the workflow.
@@ -69,7 +70,7 @@ jobs:
           git merge --no-commit origin/$SOURCE_BRANCH
           git checkout edge -- docs/config.toml docs/layouts/partials/hooks/body-end.html
           git commit --signoff --message "Upmerge to edge"
-          
+
           if git diff --quiet edge; then
               echo "No changes to merge from $SOURCE_BRANCH to edge"
               echo "NO_CHANGES=true" >> $GITHUB_ENV
@@ -77,7 +78,7 @@ jobs:
               echo "Pushing $BRANCH_NAME for PR to edge"
               git push --set-upstream origin $BRANCH_NAME
           fi
-      
+
       # Create a PR from the new branch to edge
       - name: Create pull request
         if: env.NO_CHANGES != 'true'
diff --git a/.github/workflows/validate-bicep.yaml b/.github/workflows/validate-bicep.yaml
index 6493bb0a6..fbdf4c8a0 100644
--- a/.github/workflows/validate-bicep.yaml
+++ b/.github/workflows/validate-bicep.yaml
@@ -4,7 +4,7 @@
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
-#    
+#
 #     http://www.apache.org/licenses/LICENSE-2.0
 #
 # Unless required by applicable law or agreed to in writing, software
@@ -14,7 +14,10 @@
 # limitations under the License.
 # ------------------------------------------------------------
 
+# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
+---
 name: Validate Bicep Code
+
 on:
   pull_request:
     branches:
@@ -24,17 +27,20 @@ on:
     branches:
       - edge
       - v*
+
 jobs:
   build:
     name: Validate Bicep Code
     runs-on: ubuntu-latest
     steps:
-    - name: Check out repo
-      uses: actions/checkout@v4
-    - name: Setup and verify bicep CLI
-      run: |
-        curl -Lo rad-bicep https://github.com/Azure/bicep/releases/latest/download/bicep-linux-x64
-        chmod +x ./rad-bicep
-        ./rad-bicep --version
-    - name: Verify Bicep files
-      run: python ./.github/scripts/validate_bicep.py
+      - name: Check out repo
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
+
+      - name: Setup and verify bicep CLI
+        run: |
+          curl -Lo rad-bicep https://github.com/Azure/bicep/releases/latest/download/bicep-linux-x64
+          chmod +x ./rad-bicep
+          ./rad-bicep --version
+
+      - name: Verify Bicep files
+        run: python ./.github/scripts/validate_bicep.py
diff --git a/.github/workflows/website.yaml b/.github/workflows/website.yaml
index dd31ec4bc..a03e9bddc 100644
--- a/.github/workflows/website.yaml
+++ b/.github/workflows/website.yaml
@@ -1,3 +1,5 @@
+# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
+---
 name: Radius Website
 
 on:
@@ -14,7 +16,7 @@ on:
 
 permissions:
   id-token: write # Required for requesting the JWT
-  contents: read  # Required for actions/checkout
+  contents: read # Required for actions/checkout
 
 jobs:
   build:
@@ -25,33 +27,38 @@ jobs:
       # If a PR into edge, use 'edge'. If a PR into anywhere else, use 'latest'. If a push, use the branch name.
       name: ${{ github.event_name == 'pull_request' && (github.base_ref == 'edge' && 'edge' || 'latest') || github.ref_name }}
     env:
-      GOVER: '^1.17'
-      TUTORIAL_PATH: './docs/content/user-guides/tutorials/'
-      CODE_ZIP_PATH: './docs/static/tutorial/'
+      GOVER: "^1.17"
+      TUTORIAL_PATH: "./docs/content/user-guides/tutorials/"
+      CODE_ZIP_PATH: "./docs/static/tutorial/"
       HUGO_VERSION: 0.117.0
       HUGO_ENV: production
     steps:
       - name: Checkout docs repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           submodules: true
+
       - name: Parse release version and set environment variables
         run: python ./.github/scripts/get_docs_version.py
+
       - name: Checkout radius repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           repository: radius-project/radius
           ref: ${{ env.RELEASE_BRANCH }}
           path: ./radius
+
       - name: Setup Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
         with:
-          node-version: '14'
+          node-version: "14"
+
       - name: Setup Hugo
-        uses: peaceiris/actions-hugo@v2.6.0
+        uses: peaceiris/actions-hugo@75d2e84710de30f6ff7268e08f310b60ef14033f # v3.0.0
         with:
           hugo-version: ${{ env.HUGO_VERSION }}
           extended: true
+
       - name: Setup Docsy
         run: |
           cd docs
@@ -60,14 +67,16 @@ jobs:
           cd themes/docsy
           npm install
       - name: Generate Swagger docs
-        run : |
+        run: |
           mkdir -p ./docs/static/swagger
           cp -r ./radius/swagger ./docs/static/
+
       - name: Override git_branch for PR
         if: github.event_name == 'pull_request'
         run: |
           # Within docs/config.toml, replace the line that starts with "github_branch" with "github_branch: $GITHUB_HEAD_REF"
           sed -i "s|github_branch = .*|github_branch = \"$GITHUB_HEAD_REF\"|" docs/config.toml
+
       - name: Build Hugo Site
         run: |
           cd docs
@@ -75,17 +84,18 @@ jobs:
             STAGING_URL="https://${{ vars.ENV_STATICWEBAPP_BASE }}-${{github.event.number }}.westus2.3.azurestaticapps.net/"
           fi
           hugo ${STAGING_URL+-b "$STAGING_URL"}
+
       - name: Upload Hugo artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: hugo_build
           path: ./docs/public/
           if-no-files-found: error
-  
+
   deploy:
     name: Deploy Hugo Website to App Service
     if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
-    needs: ['build']
+    needs: [build]
     runs-on: ubuntu-latest
     environment:
       # If push to edge, use 'edge'. If push to anywhere else, use 'latest'.
@@ -93,22 +103,25 @@ jobs:
       url: ${{ github.ref_name == 'edge' && 'https://edge.docs.radapp.io' || 'https://docs.radapp.io' }}
     steps:
       - name: Checkout docs repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           submodules: false
+
       - name: Download Hugo artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         with:
           name: hugo_build
           path: site/
+
       - name: Login to Azure
-        uses: azure/login@v2
+        uses: azure/login@a457da9ea143d694b1b9c7c869ebb04ebe844ef5 # v2.3.0
         with:
           client-id: ${{ secrets.AZURE_SP_TESTS_APPID }}
           tenant-id: ${{ secrets.AZURE_SP_TESTS_TENANTID }}
           subscription-id: ${{ vars.ENV_APPSERVICE_SUBSCRIPTIONID }}
+
       - name: Deploy to WebApp
-        uses: Azure/webapps-deploy@v3
+        uses: Azure/webapps-deploy@657f0700ea5214d56a0400d8ac5e8023c963d25d # v3.0.6
         with:
           app-name: ${{ vars.ENV_APPSERVICE_NAME }}
           resource-group-name: ${{ vars.ENV_APPSERVICE_RESOURCEGROUP }}
@@ -116,7 +129,7 @@ jobs:
 
   deploy-website:
     name: Deploy Hugo Website
-    needs: ['build']
+    needs: [build]
     runs-on: ubuntu-latest
     environment:
       # If a PR or push into edge, use 'edge'. If a PR or push into anywhere else, use 'latest'.
@@ -125,19 +138,20 @@ jobs:
       url: ${{ github.event_name == 'pull_request' && '' || (github.ref_name == 'edge' && 'https://edge.docs.radapp.io' || 'https://docs.radapp.io') }}
     steps:
       - name: Download Hugo artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         with:
           name: hugo_build
           path: site/
+
       - name: Deploy staging site
-        uses: Azure/static-web-apps-deploy@v1
+        uses: Azure/static-web-apps-deploy@4d27395796ac319302594769cfe812bd207490b1 # v1
         with:
           azure_static_web_apps_api_token: ${{ secrets.ENV_STATICWEBAPP_TOKEN }}
           skip_deploy_on_missing_secrets: true
-          repo_token: ${{ secrets.GITHUB_TOKEN }}
-          action: "upload"
-          app_location: "site/"
-          api_location: "site/" 
+          repo_token: ${{ github.token }}
+          action: upload
+          app_location: site/
+          api_location: site/
           output_location: ""
           skip_app_build: true
 
@@ -148,20 +162,21 @@ jobs:
     environment:
       # If a PR into edge, use 'edge'. If a PR into anywhere else, use 'latest'.
       name: ${{ github.base_ref == 'edge' && 'edge' || 'latest' }}
-      url:  ${{ github.base_ref == 'edge' && 'https://edge.docs.radapp.io' || 'https://docs.radapp.io' }}
+      url: ${{ github.base_ref == 'edge' && 'https://edge.docs.radapp.io' || 'https://docs.radapp.io' }}
     steps:
       - name: Close Pull Request
         id: closepullrequest
-        uses: Azure/static-web-apps-deploy@v1
+        uses: Azure/static-web-apps-deploy@4d27395796ac319302594769cfe812bd207490b1 # v1
         with:
           azure_static_web_apps_api_token: ${{ secrets.ENV_STATICWEBAPP_TOKEN }}
           skip_deploy_on_missing_secrets: true
-          action: "close"
+          action: close
+          app_location: site/
 
   algolia_index:
     name: Index site for Algolia
     if: github.event_name == 'push'
-    needs: ['build', 'deploy']
+    needs: ["build", "deploy"]
     runs-on: ubuntu-latest
     environment:
       # If push to edge, use 'edge'. If push to anywhere else, use 'latest'.
@@ -172,17 +187,20 @@ jobs:
       ALGOLIA_INDEX_NAME: ${{ secrets.ENV_ALGOLIA_INDEXNAME }}
     steps:
       - name: Checkout docs repo
-        uses: actions/checkout@v4
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           submodules: false
+
       - name: Download Hugo artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         with:
           name: hugo_build
           path: site/
+
       - name: Install Python packages
         run: |
           pip install --upgrade bs4
           pip install --upgrade 'algoliasearch>=2.0,<3.0'
+
       - name: Index site
         run: python ./.github/scripts/algolia.py ./site