diff --git a/.github/actions/setup-sdk-environment/action.yml b/.github/actions/setup-sdk-environment/action.yml
index 30d8df447..e90b546c1 100644
--- a/.github/actions/setup-sdk-environment/action.yml
+++ b/.github/actions/setup-sdk-environment/action.yml
@@ -10,14 +10,13 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: astral-sh/setup-uv@cec208311dfd045dd5311c1add060b2062131d57
+    - uses: astral-sh/setup-uv@68559e99cc807c1eb7e9238fd43a15bba460eec2 # v10.3.3
       with:
-        version: 0.11.6
         python-version: 3.13
         activate-environment: true
         enable-cache: true
         cache-python: true
-    - name: Install dependencies from the ${{ inputs.deps-group }} group
+    - name: Install dependencies from ${{ inputs.deps-group }} deps group
       env:
         SDK_DEPS_GROUP: ${{ inputs.deps-group }}
       shell: bash
diff --git a/.github/workflows/appinspect.yml b/.github/workflows/appinspect.yml
index e1e303486..7d47eb621 100644
--- a/.github/workflows/appinspect.yml
+++ b/.github/workflows/appinspect.yml
@@ -16,7 +16,7 @@ jobs:
     name: Run AppInspect
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: ./.github/actions/setup-sdk-environment
diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 0c9a9504b..1767db29d 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -21,7 +21,7 @@ jobs:
     outputs:
       version: ${{ steps.get-version.outputs.version }}
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: ./.github/actions/setup-sdk-environment
@@ -54,14 +54,14 @@ jobs:
         if: startsWith(github.ref, 'refs/tags/') == true
         uses: ./.github/actions/run-appinspect
       - name: Upload distributables
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: splunk-sdk-${{ steps.get-version.outputs.version }}
           path: dist/
       - name: Generate API reference
         run: make docs-zip
       - name: Upload docs artifact
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: python-sdk-docs
           path: docs/_build/splunk-sdk-python-docs.zip
@@ -78,12 +78,12 @@ jobs:
       url: https://test.pypi.org/project/splunk-sdk/
     steps:
       - name: Download distributables
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: splunk-sdk-${{ needs.build-distributables.outputs.version }}
           path: dist/
       - name: Publish packages to Test PyPI
-        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
         with:
           repository-url: https://test.pypi.org/legacy/
 
@@ -99,11 +99,11 @@ jobs:
       url: https://pypi.org/project/splunk-sdk/
     steps:
       - name: Download distributables
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: splunk-sdk-${{ needs.build-distributables.outputs.version }}
           path: dist/
       - name: Publish packages to PyPI
-        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247
+        uses: pypa/gh-action-pypi-publish@7245906fb61fa33a13554f9d5fb856fe61758086 # v1.14.3
         with:
           repository-url: https://upload.pypi.org/legacy/
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 0d341bdd0..51321b5d2 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -16,7 +16,7 @@ jobs:
     name: Run linters
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: ./.github/actions/setup-sdk-environment
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index b53fc605e..539efba0f 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -1,5 +1,7 @@
 name: Python SDK CI
 on:
+  schedule:
+    - cron: "0 0 * * 0"
   push:
     branches: [develop, master]
   pull_request:
@@ -19,12 +21,15 @@ jobs:
       matrix:
         splunk-version: [latest]
     steps:
-      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - uses: ./.github/actions/setup-sdk-environment
         with:
           deps-group: test
+      - name: (weekly deps check) Upgrade dependencies to latest
+        if: github.event_name == 'schedule'
+        run: uv sync --no-config --upgrade --group test
       - name: Download Splunk MCP Server App
         continue-on-error: true
         env:
@@ -52,7 +57,7 @@ jobs:
           echo "internal_ai_base_url=$INTERNAL_AI_BASE_URL" >> .env
       - name: Restore pytest cache
         if: ${{ github.ref != 'refs/heads/master' && github.ref != 'refs/heads/develop' }}
-        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: .pytest_cache
           key: pytest-cache-${{ runner.os }}-${{ github.ref_name }}-${{ github.sha }}