diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml
index 1dba97e..edcfb2a 100644
--- a/.github/workflows/bench.yml
+++ b/.github/workflows/bench.yml
@@ -11,8 +11,8 @@ jobs:
     name: Criterion benchmark
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: boa-dev/criterion-compare-action@v3
+      - uses: actions/checkout@v4.2.2
+      - uses: boa-dev/criterion-compare-action@v3.2.4
         with:
           branchName: ${{ github.base_ref }}
           benchName: "bench_archive"
diff --git a/.github/workflows/mla_release.yml b/.github/workflows/mla_release.yml
index 572e69e..451498f 100644
--- a/.github/workflows/mla_release.yml
+++ b/.github/workflows/mla_release.yml
@@ -67,8 +67,8 @@ jobs:
     runs-on: ${{ matrix.os }}
 
     steps:
-    - uses: actions/checkout@v2
-    - uses: actions-rs/toolchain@v1
+    - uses: actions/checkout@v4.2.2
+    - uses: actions-rs/toolchain@8e603f32c5c6eeca5b1b2d9d1e7464d926082f1d # v1.0.0
       with:
         toolchain: stable
         target: ${{ matrix.target }}
@@ -80,7 +80,7 @@ jobs:
         command: build
         args: ${{ matrix.cargo_arg }} --manifest-path=bindings/C/Cargo.toml --target=${{ matrix.target }}
     - name: Upload resulting 'mla'
-      uses: actions/upload-artifact@v3.2.1
+      uses: actions/upload-artifact@v4.4.3
       with:
         name: mla-${{ matrix.build }}
         path: ${{ matrix.path }}
@@ -98,7 +98,7 @@ jobs:
           echo "using version tag ${GITHUB_REF:15}"
           echo "version=${GITHUB_REF:15}" >> $GITHUB_OUTPUT
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4.2.2
       - name: Get Changelog Entry
         id: changelog_reader
         uses: mindsers/changelog-reader-action@v2
@@ -106,7 +106,7 @@ jobs:
           path: ./mla/CHANGELOG.md
       - name: Create Release
         id: create_release
-        uses: actions/create-release@v1
+        uses: actions/create-release@v1.1.4
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -197,7 +197,7 @@ jobs:
           asset_content_type: application/zip
           asset_name: libmla-windows-x86_64-debug-${{ steps.get_version.outputs.VERSION }}.zip
 
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4.2.2
       - name: Release C Header file
         uses: actions/upload-release-asset@v1.0.2
         env:
diff --git a/.github/workflows/mlar_release.yml b/.github/workflows/mlar_release.yml
index 2f41b4c..cc94243 100644
--- a/.github/workflows/mlar_release.yml
+++ b/.github/workflows/mlar_release.yml
@@ -30,8 +30,8 @@ jobs:
     runs-on: ${{matrix.os}}
 
     steps:
-    - uses: actions/checkout@v2
-    - uses: actions-rs/toolchain@v1
+    - uses: actions/checkout@v4.2.2
+    - uses: actions-rs/toolchain@8e603f32c5c6eeca5b1b2d9d1e7464d926082f1d # v1.0.0
       with:
         toolchain: stable
     - name: Set target if any
@@ -46,7 +46,7 @@ jobs:
       if: matrix.build == 'linux'
       run: strip ./target/${{ matrix.target }}/release/mlar${{ matrix.extension }}
     - name: Upload resulting 'mlar'
-      uses: actions/upload-artifact@v3.2.1
+      uses: actions/upload-artifact@v4.4.3
       with:
         name: mlar-${{ matrix.build }}
         path: ./target/${{ matrix.target }}/release/mlar${{ matrix.extension }}
@@ -64,7 +64,7 @@ jobs:
           echo "using version tag ${GITHUB_REF:15}"
           echo "version=${GITHUB_REF:15}" >> $GITHUB_OUTPUT
       - name: Checkout code
-        uses: actions/checkout@v2
+        uses: actions/checkout@v4.2.2
       - name: Get Changelog Entry
         id: changelog_reader
         uses: mindsers/changelog-reader-action@v2
@@ -72,7 +72,7 @@ jobs:
           path: ./mlar/CHANGELOG.md
       - name: Create Release
         id: create_release
-        uses: actions/create-release@v1
+        uses: actions/create-release@v1.1.4
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
diff --git a/.github/workflows/py-bindings.yml b/.github/workflows/py-bindings.yml
index 57b9c78..1c1f451 100644
--- a/.github/workflows/py-bindings.yml
+++ b/.github/workflows/py-bindings.yml
@@ -33,8 +33,8 @@ jobs:
           - runner: ubuntu-latest
             target: ppc64le
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v4.2.2
+      - uses: actions/setup-python@v5.3.0
         with:
           python-version: '3.11'
       - name: Build wheels
@@ -45,7 +45,7 @@ jobs:
           sccache: 'true'
           manylinux: auto
       - name: Upload wheels
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v4.4.3
         with:
           name: wheels-linux-${{ matrix.platform.target }}
           path: dist
@@ -70,8 +70,8 @@ jobs:
           - runner: windows-latest
             target: x86
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v4.2.2
+      - uses: actions/setup-python@v5.3.0
         with:
           python-version: '3.11'
           architecture: ${{ matrix.platform.target }}
@@ -82,7 +82,7 @@ jobs:
           args: --release --out dist --find-interpreter --manifest-path bindings/python/Cargo.toml
           sccache: 'true'
       - name: Upload wheels
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v4.4.3
         with:
           name: wheels-windows-${{ matrix.platform.target }}
           path: dist
@@ -107,8 +107,8 @@ jobs:
           - runner: macos-14
             target: aarch64
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@v4.2.2
+      - uses: actions/setup-python@v5.3.0
         with:
           python-version: '3.11'
       - name: Build wheels
@@ -118,7 +118,7 @@ jobs:
           args: --release --out dist --find-interpreter --manifest-path bindings/python/Cargo.toml
           sccache: 'true'
       - name: Upload wheels
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v4.4.3
         with:
           name: wheels-macos-${{ matrix.platform.target }}
           path: dist
@@ -134,14 +134,14 @@ jobs:
   sdist:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4.2.2
       - name: Build sdist
         uses: PyO3/maturin-action@v1
         with:
           command: sdist
           args: --out dist --manifest-path bindings/python/Cargo.toml
       - name: Upload sdist
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v4.4.3
         with:
           name: wheels-sdist
           path: dist
\ No newline at end of file
diff --git a/.github/workflows/sanitize.yml b/.github/workflows/sanitize.yml
index c93e5d9..f7b4725 100644
--- a/.github/workflows/sanitize.yml
+++ b/.github/workflows/sanitize.yml
@@ -17,8 +17,8 @@ jobs:
     # Assert .h and .hpp bindings files are the ones generated
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
-    - uses: actions-rs/toolchain@v1
+    - uses: actions/checkout@v4.2.2
+    - uses: actions-rs/toolchain@8e603f32c5c6eeca5b1b2d9d1e7464d926082f1d # v1.0.0
       with:
         toolchain: stable
     - uses: actions-rs/cargo@v1
@@ -47,7 +47,7 @@ jobs:
 
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v4.2.2
     - name: Get ${{ matrix.changelog }} Changelog Entry
       uses: mindsers/changelog-reader-action@v2
       id: changelog_reader
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 817de51..f1dc20a 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -28,8 +28,8 @@ jobs:
     runs-on: ${{matrix.os}}
 
     steps:
-    - uses: actions/checkout@v2
-    - uses: actions-rs/toolchain@v1
+    - uses: actions/checkout@v4.2.2
+    - uses: actions-rs/toolchain@8e603f32c5c6eeca5b1b2d9d1e7464d926082f1d # v1.0.0
       with:
         toolchain: stable
     - name: Build
@@ -42,7 +42,7 @@ jobs:
     - name: Run tests
       run: cargo test --all --exclude mla-fuzz-afl --release --verbose
     - name: Upload resulting 'mlar'
-      uses: actions/upload-artifact@v3.2.1
+      uses: actions/upload-artifact@v4.4.3
       with:
         name: ${{ matrix.build }}
         path: ./target/release/mlar${{ matrix.extension }}
@@ -51,8 +51,8 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v2
-    - uses: actions-rs/toolchain@v1
+    - uses: actions/checkout@v4.2.2
+    - uses: actions-rs/toolchain@8e603f32c5c6eeca5b1b2d9d1e7464d926082f1d # v1.0.0
       with:
         toolchain: stable
     - name: Run long tests
@@ -62,8 +62,8 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v2
-    - uses: actions-rs/toolchain@v1
+    - uses: actions/checkout@v4.2.2
+    - uses: actions-rs/toolchain@8e603f32c5c6eeca5b1b2d9d1e7464d926082f1d # v1.0.0
       with:
         toolchain: stable
     - name: Run long tests
@@ -72,8 +72,8 @@ jobs:
   test-bindings-c-cpp-linux:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
-    - uses: actions-rs/toolchain@v1
+    - uses: actions/checkout@v4.2.2
+    - uses: actions-rs/toolchain@8e603f32c5c6eeca5b1b2d9d1e7464d926082f1d # v1.0.0
       with:
         toolchain: stable
     - name: Run C bindings tests on Linux
@@ -103,8 +103,8 @@ jobs:
             msvc_platform: x64
     runs-on: windows-latest
     steps:
-    - uses: actions/checkout@v2
-    - uses: actions-rs/toolchain@v1
+    - uses: actions/checkout@v4.2.2
+    - uses: actions-rs/toolchain@8e603f32c5c6eeca5b1b2d9d1e7464d926082f1d # v1.0.0
       with:
         # pin to 1.82 cf. https://github.com/ANSSI-FR/MLA/pull/227#issuecomment-2545916785
         toolchain: 1.82
@@ -122,8 +122,8 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions-rs/toolchain@v1
+      - uses: actions/checkout@v4.2.2
+      - uses: actions-rs/toolchain@8e603f32c5c6eeca5b1b2d9d1e7464d926082f1d # v1.0.0
         with:
           toolchain: stable
       - name: Install dependencies
@@ -142,8 +142,8 @@ jobs:
   fmt:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions-rs/toolchain@v1
+      - uses: actions/checkout@v4.2.2
+      - uses: actions-rs/toolchain@8e603f32c5c6eeca5b1b2d9d1e7464d926082f1d # v1.0.0
         with:
           toolchain: stable
           components: rustfmt
@@ -153,7 +153,7 @@ jobs:
   audit:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4.2.2
       - name: Security audit
         uses: actions-rs/audit-check@v1
         with:
@@ -162,8 +162,8 @@ jobs:
   clippy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - uses: actions-rs/toolchain@v1
+      - uses: actions/checkout@v4.2.2
+      - uses: actions-rs/toolchain@8e603f32c5c6eeca5b1b2d9d1e7464d926082f1d # v1.0.0
         with:
           toolchain: stable
           components: clippy
@@ -184,8 +184,8 @@ jobs:
       runs-on: ubuntu-latest
 
       steps:
-      - uses: actions/checkout@v2
-      - uses: actions-rs/toolchain@v1
+      - uses: actions/checkout@v4.2.2
+      - uses: actions-rs/toolchain@8e603f32c5c6eeca5b1b2d9d1e7464d926082f1d # v1.0.0
         with:
           toolchain: stable
       - name: Dry-run publish curve25519-parser