diff --git a/.github/actions/setup-rust-stellar/action.yml b/.github/actions/setup-rust-stellar/action.yml
index 788cf54..0f39847 100644
--- a/.github/actions/setup-rust-stellar/action.yml
+++ b/.github/actions/setup-rust-stellar/action.yml
@@ -4,10 +4,10 @@ runs:
   using: composite
   steps:
     - name: Cache Rust dependencies
-      uses: Swatinem/rust-cache@v2
+      uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
 
     - name: Install Rust
-      uses: dtolnay/rust-toolchain@master
+      uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # stable (rust 1.97.1)
       with:
         toolchain: stable
         targets: wasm32v1-none
@@ -18,9 +18,21 @@ runs:
 
     - name: Install Stellar CLI
       run: |
-        wget -q https://github.com/stellar/stellar-cli/releases/download/v23.1.3/stellar-cli-23.1.3-x86_64-unknown-linux-gnu.tar.gz
-        tar xvf stellar-cli-23.1.3-x86_64-unknown-linux-gnu.tar.gz
-        sudo mv stellar /usr/local/bin/
+        STELLAR_VERSION="23.1.3"
+        STELLAR_TAR="stellar-cli-${STELLAR_VERSION}-x86_64-unknown-linux-gnu.tar.gz"
+        # Official SHA-256 from https://github.com/stellar/stellar-cli/releases/tag/v23.1.3
+        STELLAR_SHA256="cca0a9e249176b15ac2d63a394b383c0699dd59cd52b67cd9593427f0d039d87"
+
+        wget -q "https://github.com/stellar/stellar-cli/releases/download/v${STELLAR_VERSION}/${STELLAR_TAR}"
+
+        # Verify SHA-256 checksum
+        echo "${STELLAR_SHA256}  ${STELLAR_TAR}" | sha256sum -c - || {
+          echo "::error::Stellar CLI tarball checksum verification failed for v${STELLAR_VERSION}"
+          exit 1
+        }
+
+        # Extract with restrictive permissions
+        tar xf "${STELLAR_TAR}" --no-same-owner --no-same-permissions -C /tmp
+        sudo mv /tmp/stellar /usr/local/bin/
         stellar --version
       shell: bash
-
diff --git a/.github/workflows/rustfmt.yml b/.github/workflows/rustfmt.yml
index 764263c..89cd95d 100644
--- a/.github/workflows/rustfmt.yml
+++ b/.github/workflows/rustfmt.yml
@@ -15,7 +15,6 @@ on:
 permissions:
   contents: read
   actions: read
-  id-token: write
 
 jobs:
   rustfmt:
@@ -23,12 +22,13 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          persist-credentials: false
 
       - name: Install Rust
-        uses: actions-rs/toolchain@v1
+        uses: dtolnay/rust-toolchain@2c7215f132e9ebf062739d9130488b56d53c060c # stable (rust 1.97.1)
         with:
-          profile: minimal
           toolchain: stable
           components: rustfmt
 
diff --git a/.github/workflows/verify-build.yml b/.github/workflows/verify-build.yml
index ecc4a11..8345dad 100644
--- a/.github/workflows/verify-build.yml
+++ b/.github/workflows/verify-build.yml
@@ -26,14 +26,15 @@ on:
 permissions:
   contents: read
   actions: read
-  id-token: write
 
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout your repository using git
-        uses: actions/checkout@v4
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
+        with:
+          persist-credentials: false
 
       - name: Setup Rust and Stellar
         uses: ./.github/actions/setup-rust-stellar