diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 5e4d6dc1a1..2a262425c9 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -18,8 +18,9 @@ jobs:
     outputs:
       skip: ${{ steps.check_docs_only.outputs.skip }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
+          fetch-tags: true
           fetch-depth: 0
       - id: check_docs_only
         # Since PR's are squashed prior to merging to the branch checked out (default branch),
@@ -39,12 +40,13 @@ jobs:
     environment: deploy
     steps:
     - name: checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       with:
+        fetch-tags: true
         fetch-depth: 0
 
     - name: install
-      uses: actions/setup-go@v6
+      uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
       with:
         go-version-file: "go.mod"
 
@@ -77,14 +79,14 @@ jobs:
     steps:
 
     - name: set up qemu
-      uses: docker/setup-qemu-action@v3
+      uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
 
     - name: set up buildx
-      uses: docker/setup-buildx-action@v3
+      uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
     - name: quay.io login
       if: ${{ github.event_name != 'pull_request' }}
-      uses: docker/login-action@v3
+      uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
       with:
         username: ${{ secrets.QUAY_USERNAME }}
         password: ${{ secrets.QUAY_PASSWORD }}
@@ -92,8 +94,9 @@ jobs:
 
     # Check out repo before tag step for script.
     - name: checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       with:
+        fetch-tags: true
         fetch-depth: 0
 
     - name: create tags
@@ -123,14 +126,14 @@ jobs:
     steps:
 
     - name: set up qemu
-      uses: docker/setup-qemu-action@v3
+      uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
 
     - name: set up buildx
-      uses: docker/setup-buildx-action@v3
+      uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
     - name: quay.io login
       if: ${{ github.event_name != 'pull_request' }}
-      uses: docker/login-action@v3
+      uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
       with:
         username: ${{ secrets.QUAY_USERNAME }}
         password: ${{ secrets.QUAY_PASSWORD }}
@@ -138,8 +141,9 @@ jobs:
 
     # Check out repo before tag step for script.
     - name: checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       with:
+        fetch-tags: true
         fetch-depth: 0
 
     - name: create tags
diff --git a/.github/workflows/freshen-images.yml b/.github/workflows/freshen-images.yml
index aa3dde2ff0..ce316eb2d9 100644
--- a/.github/workflows/freshen-images.yml
+++ b/.github/workflows/freshen-images.yml
@@ -18,7 +18,7 @@ jobs:
       git_tags: ${{ steps.tags.outputs.git_tags }}
     steps:
     - name: checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       with:
         fetch-depth: 0
     - id: tags
@@ -35,17 +35,17 @@ jobs:
         id: ["operator-sdk", "helm-operator", "scorecard-test"]
     steps:
     - name: set up qemu
-      uses: docker/setup-qemu-action@v3
+      uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
     - name: set up buildx
-      uses: docker/setup-buildx-action@v3
+      uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
     - name: quay.io login
-      uses: docker/login-action@v3
+      uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
       with:
         username: ${{ secrets.QUAY_USERNAME }}
         password: ${{ secrets.QUAY_PASSWORD }}
         registry: quay.io
     - name: checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       with:
         fetch-depth: 1
     - name: build and push
diff --git a/.github/workflows/integration.yml b/.github/workflows/integration.yml
index ceab50c55d..428e8894b0 100644
--- a/.github/workflows/integration.yml
+++ b/.github/workflows/integration.yml
@@ -9,7 +9,7 @@ jobs:
     outputs:
       skip: ${{ steps.check_docs_only.outputs.skip }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
       - id: check_docs_only
@@ -26,7 +26,7 @@ jobs:
     needs: check_docs_only
     if: needs.check_docs_only.outputs.skip != 'true'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
 
@@ -34,7 +34,7 @@ jobs:
         run: |
           .github/workflows/clean-unused-disk-space.sh
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
          go-version-file: "go.mod"
       - run: make test-e2e-integration
diff --git a/.github/workflows/olm-check.yml b/.github/workflows/olm-check.yml
index 2a10b7ccf3..edba3dbb56 100644
--- a/.github/workflows/olm-check.yml
+++ b/.github/workflows/olm-check.yml
@@ -12,7 +12,7 @@ jobs:
     name: check-olm-minor-releases
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       - id: run-check-olm
         run: ./hack/check-olm.sh
     
diff --git a/.github/workflows/rerun.yml b/.github/workflows/rerun.yml
index cc2942a3da..b30b154217 100644
--- a/.github/workflows/rerun.yml
+++ b/.github/workflows/rerun.yml
@@ -5,10 +5,12 @@ on:
 jobs:
   rerun_tests:
     name: rerun_pr_tests
-    if: ${{ github.event.issue.pull_request }}
+    if: |
+      github.event.issue.pull_request &&
+      (github.event.comment.author_association == 'OWNER' || github.event.comment.author_association == 'MEMBER')
     runs-on: ubuntu-24.04
     steps:
-    - uses: operator-framework/rerun-actions@v0.4.0
+    - uses: operator-framework/rerun-actions@6660c16a6581b198ac59545c06531a6077bf7be6 # v0.4.0
       with:
         repo_token: ${{ secrets.GITHUB_TOKEN }}
         comment_id: ${{ github.event.comment.id }}
diff --git a/.github/workflows/test-go.yml b/.github/workflows/test-go.yml
index 8e71b894fa..dd898dca25 100644
--- a/.github/workflows/test-go.yml
+++ b/.github/workflows/test-go.yml
@@ -12,7 +12,7 @@ jobs:
     outputs:
       skip: ${{ steps.check_docs_only.outputs.skip }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
       - id: check_docs_only
@@ -29,7 +29,7 @@ jobs:
     needs: check_docs_only
     if: needs.check_docs_only.outputs.skip != 'true'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
 
@@ -37,7 +37,7 @@ jobs:
         run: |
           .github/workflows/clean-unused-disk-space.sh
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version-file: "go.mod"
       - run: sudo rm -rf /usr/local/bin/kustomize
@@ -49,7 +49,7 @@ jobs:
     needs: check_docs_only
     if: needs.check_docs_only.outputs.skip != 'true'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
 
@@ -57,7 +57,7 @@ jobs:
         run: |
           .github/workflows/clean-unused-disk-space.sh
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version-file: "go.mod"
       - run: make test-unit
diff --git a/.github/workflows/test-helm.yml b/.github/workflows/test-helm.yml
index 11e5a6c086..1371a2fc7e 100644
--- a/.github/workflows/test-helm.yml
+++ b/.github/workflows/test-helm.yml
@@ -9,7 +9,7 @@ jobs:
     outputs:
       skip: ${{ steps.check_docs_only.outputs.skip }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
       - id: check_docs_only
@@ -26,7 +26,7 @@ jobs:
     needs: check_docs_only
     if: needs.check_docs_only.outputs.skip != 'true'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
 
@@ -34,7 +34,7 @@ jobs:
         run: |
           .github/workflows/clean-unused-disk-space.sh
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version-file: "go.mod"
       - run: sudo rm -rf /usr/local/bin/kustomize
diff --git a/.github/workflows/test-sample-go.yml b/.github/workflows/test-sample-go.yml
index 3d0a7a355b..ce05f7aaef 100644
--- a/.github/workflows/test-sample-go.yml
+++ b/.github/workflows/test-sample-go.yml
@@ -9,7 +9,7 @@ jobs:
     outputs:
       skip: ${{ steps.check_docs_only.outputs.skip }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
       - id: check_docs_only
@@ -26,7 +26,7 @@ jobs:
     needs: check_docs_only
     if: needs.check_docs_only.outputs.skip != 'true'
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
         with:
           fetch-depth: 0
 
@@ -34,7 +34,7 @@ jobs:
         run: |
           .github/workflows/clean-unused-disk-space.sh
 
-      - uses: actions/setup-go@v6
+      - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
         with:
           go-version-file: "go.mod"
       - run: sudo rm -rf /usr/local/bin/kustomize
diff --git a/.github/workflows/test-sanity.yml b/.github/workflows/test-sanity.yml
index 34f9f5fd82..6dea8cc99b 100644
--- a/.github/workflows/test-sanity.yml
+++ b/.github/workflows/test-sanity.yml
@@ -9,7 +9,7 @@ jobs:
     outputs:
       skip: ${{ steps.check_docs_only.outputs.skip }}
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       with:
         fetch-depth: 0
     - id: check_docs_only
@@ -26,7 +26,7 @@ jobs:
     needs: check_docs_only
     if: needs.check_docs_only.outputs.skip != 'true'
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       with:
         fetch-depth: 0
 
@@ -34,7 +34,7 @@ jobs:
       run: |
         .github/workflows/clean-unused-disk-space.sh    
 
-    - uses: actions/setup-go@v6
+    - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
       with:
         go-version-file: "go.mod"
       id: go
@@ -45,7 +45,7 @@ jobs:
     name: docs
     runs-on: ubuntu-24.04
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
       with:
         fetch-depth: 0
         submodules: recursive