diff --git a/.github/workflows/ci-health-sweep.yml b/.github/workflows/ci-health-sweep.yml
index c26d8ecc..3d705b66 100644
--- a/.github/workflows/ci-health-sweep.yml
+++ b/.github/workflows/ci-health-sweep.yml
@@ -45,6 +45,14 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     steps:
+      # Egress allowlist (RE001): this job talks only to the GitHub API.
+      - name: Harden runner
+        uses: step-security/harden-runner@v2.22.2
+        with:
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            github.com:443
       - uses: actions/checkout@v7.0.1
       - name: Run CI-health sweep
         env:
diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
index 86842d10..d1875204 100644
--- a/.github/workflows/dependabot-automerge.yml
+++ b/.github/workflows/dependabot-automerge.yml
@@ -62,6 +62,14 @@ jobs:
       pull-requests: write   # needed to approve
 
     steps:
+      # Egress allowlist (RE001): this job talks only to the GitHub API.
+      - name: Harden runner
+        uses: step-security/harden-runner@v2.22.2
+        with:
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            github.com:443
       - name: Fetch Dependabot metadata
         id: meta
         uses: dependabot/fetch-metadata@v3.1.0
diff --git a/.github/workflows/escript-soundness.yml b/.github/workflows/escript-soundness.yml
index d78e59be..d753493d 100644
--- a/.github/workflows/escript-soundness.yml
+++ b/.github/workflows/escript-soundness.yml
@@ -75,7 +75,7 @@ jobs:
     needs: startup-probe
     timeout-minutes: 20
     container:
-      image: elixir:1.17-otp-27
+      image: elixir:1.17-otp-27@sha256:c65f0bdd8827df171963e3558a1461b04efc086d0d52ee7c6900fcddb4467e08
     env:
       GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       TARGET_REF: ${{ github.sha }}
diff --git a/.github/workflows/roadmap-sync.yml b/.github/workflows/roadmap-sync.yml
index eae7a233..ea784ee8 100644
--- a/.github/workflows/roadmap-sync.yml
+++ b/.github/workflows/roadmap-sync.yml
@@ -46,6 +46,14 @@ jobs:
       EXCLUDE: 'idaptik burble rattlescript vcl-ut'
       WINDOW_MIN: ${{ inputs.window_min || '45' }}   # look-back window (> cron interval for overlap)
     steps:
+      # Egress allowlist (RE001): this job talks only to the GitHub API.
+      - name: Harden runner
+        uses: step-security/harden-runner@v2.22.2
+        with:
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+            github.com:443
       - name: Mint App installation token
         id: app
         uses: actions/create-github-app-token@v3.3.0
diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index f41b3e26..5831b4b3 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -266,7 +266,7 @@ jobs:
     needs: [build-images]
     services:
       arangodb:
-        image: arangodb:3.11
+        image: arangodb:3.11@sha256:e83f37055170f647ebca1a09dd65ec850a578d8d4c9b90904de3359b909c1f16
         env:
           ARANGO_ROOT_PASSWORD: testpassword
           ARANGO_NO_AUTH: "0"
@@ -308,7 +308,7 @@ jobs:
           --health-start-period 40s
 
       dragonfly:
-        image: docker.dragonflydb.io/dragonflydb/dragonfly:latest
+        image: ghcr.io/dragonflydb/dragonfly:v1.40.2@sha256:18afa43e911f1dff18c7d1eb452361876d9702bb1cdff5c5d75c69617a4065c9
         ports:
           - 6379:6379
         options: >-
@@ -508,7 +508,7 @@ jobs:
     needs: [integration-tests]
     services:
       arangodb:
-        image: arangodb:3.11
+        image: arangodb:3.11@sha256:e83f37055170f647ebca1a09dd65ec850a578d8d4c9b90904de3359b909c1f16
         env:
           ARANGO_ROOT_PASSWORD: testpassword
         ports:
@@ -549,7 +549,7 @@ jobs:
           --health-start-period 40s
 
       dragonfly:
-        image: docker.dragonflydb.io/dragonflydb/dragonfly:latest
+        image: ghcr.io/dragonflydb/dragonfly:v1.40.2@sha256:18afa43e911f1dff18c7d1eb452361876d9702bb1cdff5c5d75c69617a4065c9
         ports:
           - 6379:6379
         options: >-