diff --git a/.github/actions/sign-image/action.yml b/.github/actions/sign-image/action.yml
index 9aef124..cb3900a 100644
--- a/.github/actions/sign-image/action.yml
+++ b/.github/actions/sign-image/action.yml
@@ -31,7 +31,11 @@ runs:
         registry-type: public
 
     - name: Install cosign
-      uses: sigstore/cosign-installer@v4.1.2
+      uses: sigstore/cosign-installer@6f9f17788090df1f26f669e9d70d6ae9567deba6 # v4.1.2
+      with:
+        # Explicit and pinned: the installer's default drifts with its own
+        # releases; v3.1.3 is the latest stable with no known advisories.
+        cosign-release: 'v3.1.3'
 
     - name: Sign image
       shell: bash
diff --git a/.github/workflows/docker-security-scan.yml b/.github/workflows/docker-security-scan.yml
index 0af3b00..fc7bc81 100644
--- a/.github/workflows/docker-security-scan.yml
+++ b/.github/workflows/docker-security-scan.yml
@@ -71,8 +71,9 @@ jobs:
 
       - name: Run Trivy vulnerability scanner
         id: scan
-        uses: aquasecurity/trivy-action@v0.36.0
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
+          version: 'v0.74.0'
           image-ref: '${{ inputs.image_name }}:scan'
           format: 'table'
           exit-code: '${{ inputs.exit_code }}'
@@ -82,8 +83,9 @@ jobs:
 
       - name: Generate SARIF report
         if: inputs.upload_sarif
-        uses: aquasecurity/trivy-action@v0.36.0
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
+          version: 'v0.74.0'
           image-ref: '${{ inputs.image_name }}:scan'
           format: 'sarif'
           output: 'results.sarif'
diff --git a/.github/workflows/ecr-security-scan.yml b/.github/workflows/ecr-security-scan.yml
index 8259625..b41da87 100644
--- a/.github/workflows/ecr-security-scan.yml
+++ b/.github/workflows/ecr-security-scan.yml
@@ -55,10 +55,18 @@ jobs:
         with:
           registry-type: public
 
-      - name: Install Trivy
+      - name: Install Trivy (pinned + checksum verified)
         run: |
-          wget -q https://github.com/aquasecurity/trivy/releases/download/v0.69.2/trivy_0.69.2_Linux-64bit.deb
-          sudo dpkg -i trivy_0.69.2_Linux-64bit.deb
+          set -euo pipefail
+          TRIVY_VERSION="0.74.0"
+          tarball="trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz"
+          base="https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}"
+          curl -fsSLO "${base}/${tarball}"
+          curl -fsSLo trivy_checksums.txt "${base}/trivy_${TRIVY_VERSION}_checksums.txt"
+          grep " ${tarball}\$" trivy_checksums.txt | sha256sum -c -
+          tar -xzf "${tarball}" trivy
+          sudo mv trivy /usr/local/bin/trivy
+          trivy --version
 
       - name: Get latest tags and scan images
         id: scan
diff --git a/.github/workflows/pr-checks-actions.yml b/.github/workflows/pr-checks-actions.yml
index b863203..6df4025 100644
--- a/.github/workflows/pr-checks-actions.yml
+++ b/.github/workflows/pr-checks-actions.yml
@@ -35,8 +35,9 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Run Trivy secret scan
-        uses: aquasecurity/trivy-action@v0.36.0
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
+          version: 'v0.74.0'
           scan-type: 'fs'
           scan-ref: '.'
           scanners: 'secret'
diff --git a/.github/workflows/trivy-tofu-scan.yml b/.github/workflows/trivy-tofu-scan.yml
index 5ab3028..b862b9f 100644
--- a/.github/workflows/trivy-tofu-scan.yml
+++ b/.github/workflows/trivy-tofu-scan.yml
@@ -38,8 +38,9 @@ jobs:
       - name: Run Trivy IaC scan
         if: steps.find.outputs.has_tf_files == 'true'
         id: scan
-        uses: aquasecurity/trivy-action@v0.36.0
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
+          version: 'v0.74.0'
           scan-type: 'config'
           scan-ref: '.'
           format: 'json'
@@ -51,8 +52,9 @@ jobs:
 
       - name: Generate SARIF report
         if: steps.find.outputs.has_tf_files == 'true' && inputs.upload_sarif
-        uses: aquasecurity/trivy-action@v0.36.0
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
+          version: 'v0.74.0'
           scan-type: 'config'
           scan-ref: '.'
           format: 'sarif'