diff --git a/.github/workflows/bump.yml b/.github/workflows/bump.yml
index 77b3a97938..a338269610 100644
--- a/.github/workflows/bump.yml
+++ b/.github/workflows/bump.yml
@@ -6,7 +6,7 @@ on:
   push:
     branches:
       - master
-
+permissions: {}
 jobs:
   bump-in-dependent-projects:
     name: Bump this package in repositories that depend on it
@@ -14,7 +14,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Bumping latest version of this package in other repositories
         uses: derberg/npm-dependency-manager-for-your-github-org@1eafd3bf3974f21d395c1abac855cb04b295d570 # using v6.-.- https://github.com/derberg/npm-dependency-manager-for-your-github-org/releases/tag/v6
         with:
diff --git a/.github/workflows/local-generate-files.yml b/.github/workflows/local-generate-files.yml
index 90139bb7f5..a0eec30fd6 100644
--- a/.github/workflows/local-generate-files.yml
+++ b/.github/workflows/local-generate-files.yml
@@ -1,10 +1,12 @@
 # this workflow runs after releases to generate some files like for example api.md
 name: Autogenerate API files
 
-on: 
+on:
   release:
     types: 
       - published
+      
+permissions: {}
 
 jobs:
   version_bump:
@@ -12,22 +14,25 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           # target branch of release. More info https://docs.github.com/en/rest/reference/repos#releases
           # in case release is created from release branch then we need to checkout from given branch
           # if @semantic-release/github is used to publish, the minimum version is 7.2.0 for proper working
           ref: ${{ github.event.release.target_commitish }}
+          persist-credentials: false
+          
       - name: Check package-lock version
         # This workflow is from our own org repo and safe to reference by 'master'.
-        uses: asyncapi/.github/.github/actions/get-node-version-from-package-lock@master
+        uses: asyncapi/.github/.github/actions/get-node-version-from-package-lock@master # pinned to latest master
         id: lockversion
         with:
           node-version: ${{ vars.NODE_VERSION }}
       - name: Setup Node.js
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "${{ steps.lockversion.outputs.version }}"
+          cache: ''   # disable default npm cache which prevents cache-poisoning on release artifacts
       - name: Install dependencies
         run: npm ci
       - name: Assets generation
@@ -44,7 +49,7 @@ jobs:
           branch: assets-update/${{github.event.release.tag_name}}
       - if: failure() # Only, on failure, send a message on the 94_bot-failing-ci slack channel
         name: Report workflow run status to Slack
-        uses: 8398a7/action-slack@v3
+        uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3
         with:
           status: ${{ job.status }}
           fields: repo,action,workflow
diff --git a/.github/workflows/pr-review-checklist.yml b/.github/workflows/pr-review-checklist.yml
index c63792ab51..c110012228 100644
--- a/.github/workflows/pr-review-checklist.yml
+++ b/.github/workflows/pr-review-checklist.yml
@@ -5,6 +5,8 @@ on:
     types: 
       - opened
 
+permissions: {}
+
 jobs:
   pr-review-list:
     name: Post PR Review Checklist
@@ -14,9 +16,13 @@ jobs:
       github.event.pull_request.user.login != 'dependabot[bot]' && 
       github.event.pull_request.user.login != 'dependabot-preview[bot]') 
     runs-on: ubuntu-latest
+    permissions:
+      pull-requests: write  # permission to create-or-update-comment posts to the PR thread
     steps:
     - name: Checkout repository
-      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2 https://github.com/actions/checkout/releases/tag/v4.2.2
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+          persist-credentials: false # read-only; only used to access .github/pr-review-checklist.md
 
     - name: Post initial PR checklist
       uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 #v4.0.0 https://github.com/peter-evans/create-or-update-comment/releases/tag/v4.0.0
diff --git a/.github/workflows/pr-testing-with-test-project.yml b/.github/workflows/pr-testing-with-test-project.yml
index 72dff12ca8..ef92ebdc50 100644
--- a/.github/workflows/pr-testing-with-test-project.yml
+++ b/.github/workflows/pr-testing-with-test-project.yml
@@ -4,14 +4,20 @@ name: Test using test project
 on:
   pull_request:
     types: [opened, reopened, synchronize, ready_for_review]
-
+# Revokes default permissions since all jobs only need read access.
+permissions: {}
 jobs:
   changes:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read        # checkout
+      pull-requests: read   # paths-filter reads PR diff
     outputs:
       should_test: ${{ steps.should_run.outputs.shouldrun }}
     steps:
-      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 https://github.com/actions/checkout/releases/tag/v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Checks paths-filter
         uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1 https://github.com/dorny/paths-filter/releases/tag/v4.0.1
         id: filter
@@ -38,7 +44,7 @@ jobs:
               startsWith(github.event.pull_request.title, 'ci: update of files from global .github repo') ||
                startsWith(github.event.pull_request.title, 'chore(release):')
             )) ||
-            (github.actor == 'allcontributors[bot]' &&
+            (github.actor_id == '46447321' &&
               startsWith(github.event.pull_request.title, 'docs: add')
             )
           )
@@ -50,12 +56,18 @@ jobs:
     needs: changes
     name: Test generator as dependency with Node 24
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Log should_test value across jobs #it has to stay here for some time for debugging
+        env:
+          SHOULD_TEST: ${{ needs.changes.outputs.should_test }}
         run: |
-          echo "should_test value: ${{ needs.changes.outputs.should_test }}"
+          echo "should_test value: ${SHOULD_TEST}"
       - if: needs.changes.outputs.should_test == 'true'
         name: Run test
         run: NODE_VERSION=24 docker compose up --abort-on-container-exit --force-recreate
@@ -66,6 +78,8 @@ jobs:
     needs: changes
     name: Acceptance tests (${{ matrix.language }})
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     strategy:
       fail-fast: false
@@ -74,16 +88,20 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3 https://github.com/actions/checkout/releases/tag/v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
 
       - name: Log should_test value across jobs #it has to stay here for some time for debugging
+        env:
+          SHOULD_TEST: ${{ needs.changes.outputs.should_test }}
         run: |
-          echo "should_test value: ${{ needs.changes.outputs.should_test }}"
+          echo "should_test value: ${SHOULD_TEST}"
 
       - name: Check package-lock version
         if: needs.changes.outputs.should_test == 'true'
         # This workflow is from our own org repo and safe to reference by 'master'.
-        uses: asyncapi/.github/.github/actions/get-node-version-from-package-lock@master
+        uses: asyncapi/.github/.github/actions/get-node-version-from-package-lock@master # pinned to latest master
         id: lockversion
         with:
           node-version: ${{ vars.NODE_VERSION }}
diff --git a/.github/workflows/release-with-changesets.yml b/.github/workflows/release-with-changesets.yml
index 4302cc389e..d71b19bec5 100644
--- a/.github/workflows/release-with-changesets.yml
+++ b/.github/workflows/release-with-changesets.yml
@@ -6,6 +6,9 @@ on:
     branches:
       - master
 
+# revoke default permissions
+permissions: {}
+
 jobs:
   test-nodejs:
     # We just check the message of the first commit as there is always just one commit because we squash into one before merging
@@ -20,6 +23,8 @@ jobs:
       startsWith( github.event.commits[0].message, 'feat!:' ))
     name: Test NodeJS release on ${{ matrix.os }}
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read  # no write permissions needed for testing
     strategy:
       matrix:
         os: [ubuntu-latest, macos-latest, windows-latest]
@@ -30,7 +35,9 @@ jobs:
           git config --global core.eol lf
         shell: bash
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Check if Node.js project and has package.json
         id: packagejson
         run: test -e ./package.json && echo "exists=true" >> $GITHUB_OUTPUT || echo "exists=false" >> $GITHUB_OUTPUT
@@ -38,13 +45,13 @@ jobs:
       - if: steps.packagejson.outputs.exists == 'true'
         name: Check package-lock version
         # This workflow is from our own org repo and safe to reference by 'master'.
-        uses: asyncapi/.github/.github/actions/get-node-version-from-package-lock@master
+        uses: asyncapi/.github/.github/actions/get-node-version-from-package-lock@master # pinned to latest master
         id: lockversion
         with:
           node-version: ${{ vars.NODE_VERSION }}
       - if: steps.packagejson.outputs.exists == 'true'
         name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "${{ steps.lockversion.outputs.version }}"
           registry-url: "https://registry.npmjs.org"
@@ -62,7 +69,7 @@ jobs:
         run: npm test --if-present
       - if: failure() # Only, on failure, send a message on the 94_bot-failing-ci slack channel
         name: Report workflow run status to Slack
-        uses: 8398a7/action-slack@v3
+        uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3
         with:
           status: ${{ job.status }}
           fields: repo,action,workflow
@@ -84,20 +91,22 @@ jobs:
           git config --global core.autocrlf false
           git config --global core.eol lf
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Check if Node.js project and has package.json
         id: packagejson
         run: test -e ./package.json && echo "exists=true" >> $GITHUB_OUTPUT || echo "exists=false" >> $GITHUB_OUTPUT
         shell: bash
       - if: steps.packagejson.outputs.exists == 'true'
         name: Check package-lock version
-        uses: asyncapi/.github/.github/actions/get-node-version-from-package-lock@master
+        uses: asyncapi/.github/.github/actions/get-node-version-from-package-lock@master # pinned to latest master
         with:
           node-version: ${{ vars.NODE_VERSION }}
         id: lockversion
       - if: steps.packagejson.outputs.exists == 'true'
         name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "${{ steps.lockversion.outputs.version }}"
       - if: steps.packagejson.outputs.exists == 'true'
@@ -112,7 +121,7 @@ jobs:
       - if: steps.packagejson.outputs.exists == 'true'
         name: Publish to any of NPM, Github, and Docker Hub
         #this step has 2 goals, it is either identifying that there is changeset file created and then this action creates a PR with version bump that will trigger release - or if it sees there is no changeset, and there are versions changes in package.json files, it publish new versions to NPM is they are not there yet
-        uses: changesets/action@v1
+        uses: changesets/action@63a615b9cd06ba9a3e6d13796c7fbcb080a60a0b #v1.8.0
         id: release
         with:
           # `changeset version` only rewrites package.json/CHANGELOG files; it never runs an
@@ -133,7 +142,7 @@ jobs:
           GIT_COMMITTER_EMAIL: info@asyncapi.io
       - if: failure() # Only, on failure, send a message on the 94_bot-failing-ci Slack channel
         name: Report workflow run status to Slack
-        uses: 8398a7/action-slack@v3
+        uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3
         with:
           status: ${{ job.status }}
           fields: repo,action,workflow
diff --git a/.github/workflows/update-docs-in-website.yml b/.github/workflows/update-docs-in-website.yml
index 7501f25655..304d549ed2 100644
--- a/.github/workflows/update-docs-in-website.yml
+++ b/.github/workflows/update-docs-in-website.yml
@@ -8,32 +8,45 @@ on:
       - 'apps/generator/docs/*.md'
       - '.github/workflows/update-docs-in-website.yml'
 
+permissions: {}
+
 jobs:
   Make-PR:
     name: Make PR on website repository with updated latest generator documentation
     runs-on: ubuntu-latest
+    permissions:
+      contents: write       # push to asyncapi/website via PAT
+      pull-requests: write  # gh pr create
     env:
       GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
     steps:
       - name: Checkout Current repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           path: generator
-      - name: Checkout Another repository
-        uses: actions/checkout@v3
+          persist-credentials: false # since this repo only used for reading docs
+      - name: Checkout The Website repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: asyncapi/website
           path: website
           token: ${{ env.GITHUB_TOKEN }}
+          persist-credentials: true  # needed for git push of the docs to the website repo
+
       - name: Config git
+        working-directory: ./website
         run: |
           git config --global user.name asyncapi-bot
           git config --global user.email info@asyncapi.io
+
       - name: Create branch
         working-directory: ./website
+        env:
+          SHA: ${{ github.sha }}
         run: |
-          git checkout -b update-generator-docs-${{ github.sha }}
-      - name: Copy generator folder from Current Repo to Another
+          git checkout -b "update-generator-docs-${SHA}"
+
+      - name: Copy generator folder to the website repo
         working-directory: ./website
         run: |
           rm -r ./markdown/docs/tools/generator
@@ -42,12 +55,14 @@ jobs:
           rm -r ../generator/apps/generator/docs/jsdoc2md-handlebars
           printf "%s\ntitle: Generator\nweight: 3\n%s" "---" "---"> ../generator/apps/generator/docs/_section.md
           mv ../generator/apps/generator/docs/*.md ./markdown/docs/tools/generator
+
       - name: Commit and push
         working-directory: ./website
         run: |
           git add .
           git commit -m "docs(generator): update latest generator docs"
-          git push https://${{ env.GITHUB_TOKEN }}@github.com/asyncapi/website
+          git push origin HEAD
+
       - name: Create PR
         working-directory: ./website
         run: |
diff --git a/.github/workflows/update-maintainers.yml b/.github/workflows/update-maintainers.yml
index c4cd1baa47..ab49ebb3ad 100644
--- a/.github/workflows/update-maintainers.yml
+++ b/.github/workflows/update-maintainers.yml
@@ -7,6 +7,9 @@ on:
     paths:
       - 'CODEOWNERS'
 
+# Deny-all for the built-in GITHUB_TOKEN; the job uses secrets.GH_TOKEN (PAT) for cross-repo writes.
+permissions: {}
+
 jobs:
   update-maintainers:
     runs-on: ubuntu-latest
@@ -14,31 +17,34 @@ jobs:
       GITHUB_TOKEN: ${{ secrets.GH_TOKEN }}
     steps:
       - name: Checkout main branch
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: master
           path: current_state
+          persist-credentials: false
 
       - name: Checkout one commit before last one
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 2
           ref: master
           path: previous_state
+          persist-credentials: false
 
       - run: cd previous_state && git checkout HEAD^
 
       - name: Checkout community repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           repository: asyncapi/community
           token: ${{ env.GITHUB_TOKEN }}
           path: community
+          persist-credentials: true   # needed for the `git push` later
 
       - name: Setup Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: '16'
+          node-version: '20'
 
       - name: Install js-yaml
         run: npm install js-yaml@3.14.1
@@ -47,7 +53,7 @@ jobs:
         id: compare-codeowners
         env:
           GH_TOKEN: ${{ env.GITHUB_TOKEN }}
-        uses: actions/github-script@v6
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const fs = require('fs');
@@ -149,8 +155,10 @@ jobs:
 
       - name: Create new branch
         working-directory: ./community
+        env:
+          RUN_ID: ${{ github.run_id }}
         run: |
-          git checkout -b update-maintainers-${{ github.run_id }}
+          git checkout -b update-maintainers-${RUN_ID}
 
       - name: Commit and push
         working-directory: ./community
@@ -159,17 +167,19 @@ jobs:
           git config --global user.name "asyncapi-bot"
           git add .
           git commit -m "Update MAINTAINERS.yaml"
-          git push https://${{ env.GITHUB_TOKEN }}@github.com/asyncapi/community
+          git push origin HEAD
 
       - name: Create PR
         working-directory: ./community
+        env:
+          RUN_ID: ${{ github.run_id }}
         run: |
-          gh pr create --title "docs(community): update latest maintainers list" --body "Updated Maintainers list is available and this PR introduces changes with latest information about Maintainers" --head update-maintainers-${{ github.run_id }}
+          gh pr create --title "docs(community): update latest maintainers list" --body "Updated Maintainers list is available and this PR introduces changes with latest information about Maintainers" --head update-maintainers-${RUN_ID}
 
 
       - name: Report workflow run status to Slack
         if: failure() # Only, on failure, send a message on the slack channel
-        uses: rtCamp/action-slack-notify@v2
+        uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661  #v2.3.3
         env:
           SLACK_WEBHOOK: ${{ secrets.SLACK_CI_FAIL_NOTIFY }}
           SLACK_TITLE: 🚨 Update maintainers list action failed 🚨
diff --git a/.github/workflows/verify-docs-up-to-date.yml b/.github/workflows/verify-docs-up-to-date.yml
index 4fe38cba7b..7fd657f78e 100644
--- a/.github/workflows/verify-docs-up-to-date.yml
+++ b/.github/workflows/verify-docs-up-to-date.yml
@@ -31,7 +31,7 @@ jobs:
 
       - name: Check package-lock version
         # This workflow is from our own org repo and safe to reference by 'master'.
-        uses: asyncapi/.github/.github/actions/get-node-version-from-package-lock@master # //NOSONAR
+        uses: asyncapi/.github/.github/actions/get-node-version-from-package-lock@master # pinned to latest master
         id: lockversion
         with:
           node-version: ${{ vars.NODE_VERSION }}