diff --git a/.github/actions/checkout-rust/action.yml b/.github/actions/checkout-rust/action.yml
index 67140523f20..bb65e04b336 100644
--- a/.github/actions/checkout-rust/action.yml
+++ b/.github/actions/checkout-rust/action.yml
@@ -23,7 +23,7 @@ runs:
         fi
         echo "commit=$commit" >> "$GITHUB_OUTPUT"
 
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         repository: rust-lang/rust
         ref: ${{ steps.toolchain.outputs.commit }}
diff --git a/.github/actions/rustup-cg-gcc/action.yml b/.github/actions/rustup-cg-gcc/action.yml
index b16d4a99d48..342c35d2a38 100644
--- a/.github/actions/rustup-cg-gcc/action.yml
+++ b/.github/actions/rustup-cg-gcc/action.yml
@@ -30,7 +30,7 @@ runs:
         echo "commit=$commit" >> "$GITHUB_OUTPUT"
         echo "Tested the cg_gcc of nightly-$date ([rust-lang/rust@${commit:0:11}](https://github.com/rust-lang/rust/commit/$commit))." >> "$GITHUB_STEP_SUMMARY"
 
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         repository: rust-lang/rust
         ref: ${{ steps.nightly.outputs.commit }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index fc45d1a60f8..362854c8ea0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -56,17 +56,19 @@ jobs:
             commands: "--librsvg-tests"
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     # `rustup show` installs from rust-toolchain.toml
     - name: Setup rust toolchain
       run: rustup show
 
     - name: Setup rust cache
-      uses: Swatinem/rust-cache@v2
+      uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
 
     - name: Add apt mirrors
-      uses: ./.github/actions/apt-mirrors
+      uses: $/.github/actions/apt-mirrors
 
     - name: Install packages
       # `llvm-tools` is needed to install the `FileCheck` binary which is used for asm tests.
@@ -81,12 +83,18 @@ jobs:
       run: sudo apt-get install libcairo2-dev libpango1.0-dev libfontconfig1-dev libfreetype-dev libharfbuzz-dev libxml2-dev libglib2.0-dev
 
     - name: Download artifact
-      run: curl -LO https://github.com/rust-lang/gcc/releases/latest/download/${{ matrix.libgccjit_version.gcc }}${{ matrix.os.asset_name_suffix }}.deb
+      run: curl -LO https://github.com/rust-lang/gcc/releases/latest/download/${LIBGCCJIT_GCC}${ASSET_NAME_SUFFIX}.deb
+      env:
+        ASSET_NAME_SUFFIX: ${{ matrix.os.asset_name_suffix }}
+        LIBGCCJIT_GCC: ${{ matrix.libgccjit_version.gcc }}
 
     - name: Setup path to libgccjit
       run: |
-          sudo dpkg --force-overwrite -i ${{ matrix.libgccjit_version.gcc }}${{ matrix.os.asset_name_suffix }}.deb
+          sudo dpkg --force-overwrite -i ${LIBGCCJIT_GCC}${ASSET_NAME_SUFFIX}.deb
           echo 'gcc-path = "/usr/lib/"' > config.toml
+      env:
+        ASSET_NAME_SUFFIX: ${{ matrix.os.asset_name_suffix }}
+        LIBGCCJIT_GCC: ${{ matrix.libgccjit_version.gcc }}
 
     # Some run-make tests fail if we use our forked GCC because it doesn't
     # bundle libstdc++, so we switch to gcc-14 to have a GCC that has
@@ -149,9 +157,11 @@ jobs:
         ./y.sh test --cargo-tests
         CARGO_TEST_FLAGS="-Zmir-preserve-ub" ./y.sh test --cargo-tests -- mir_preserve_ub_empty_switch
         # The lock-free 128-bit atomics need native 128-bit integers.
-        if [ "${{ matrix.libgccjit_version.gcc }}" != "gcc-15-without-int128" ]; then
+        if [ "${LIBGCCJIT_GCC}" != "gcc-15-without-int128" ]; then
           CARGO_TEST_FLAGS="-Ctarget-feature=+cmpxchg16b" ./y.sh test --cargo-tests -- atomic_u128
         fi
+      env:
+        LIBGCCJIT_GCC: ${{ matrix.libgccjit_version.gcc }}
 
     - name: Run y.sh cargo build
       if: ${{ matrix.run_checks }}
@@ -175,22 +185,28 @@ jobs:
 
     - name: Check out rust-lang/rust
       if: ${{ contains(matrix.commands, '-rustc') }}
-      uses: ./.github/actions/checkout-rust
+      uses: $/.github/actions/checkout-rust
 
     - name: Run tests
       run: |
-        ./y.sh test --release --clean --build-sysroot --no-builtins-tests ${{ matrix.commands }}
+        ./y.sh test --release --clean --build-sysroot --no-builtins-tests ${MATRIX_COMMANDS}
+      env:
+        MATRIX_COMMANDS: ${{ matrix.commands }}
 
   duplicates:
     runs-on: ubuntu-26.04
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - run: python tools/check_intrinsics_duplicates.py
 
   build_system:
     runs-on: ubuntu-26.04
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
       - name: Test build system
         run: |
           cd build_system
@@ -211,6 +227,8 @@ jobs:
       - name: Conclusion
         run: |
           # Print the dependent jobs to see them in the CI log
-          jq -C <<< '${{ toJson(needs) }}'
+          jq -C <<< "${NEEDS_JSON}"
           # Check if all jobs that we depend on (in the needs array) were successful.
-          jq --exit-status 'all(.result == "success")' <<< '${{ toJson(needs) }}'
+          jq --exit-status 'all(.result == "success")' <<< "${NEEDS_JSON}"
+        env:
+          NEEDS_JSON: ${{ toJson(needs) }}
diff --git a/.github/workflows/failures.yml b/.github/workflows/failures.yml
index 23411645931..f6bb25aa67a 100644
--- a/.github/workflows/failures.yml
+++ b/.github/workflows/failures.yml
@@ -36,17 +36,19 @@ jobs:
             env_extra: "TEST_FLAGS='-Cpanic=abort -Zpanic-abort-tests' GCC_EXEC_PREFIX=/usr/lib/gcc/"
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     # `rustup show` installs from rust-toolchain.toml
     - name: Setup rust toolchain
       run: rustup show
 
     - name: Setup rust cache
-      uses: Swatinem/rust-cache@v2
+      uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
 
     - name: Add apt mirrors
-      uses: ./.github/actions/apt-mirrors
+      uses: $/.github/actions/apt-mirrors
 
     - name: Install packages
       timeout-minutes: 20
@@ -102,33 +104,39 @@ jobs:
 
     - name: Check out rust-lang/rust
       if: matrix.libgccjit_version.gcc != 'libgccjit12.so'
-      uses: ./.github/actions/checkout-rust
+      uses: $/.github/actions/checkout-rust
 
     - name: Run tests
       # FIXME: re-enable those tests for libgccjit 12.
       if: matrix.libgccjit_version.gcc != 'libgccjit12.so'
       id: tests
+      # Without `set -o pipefail`, `tee` masks the exit status of `y.sh test`.
+      # This suite runs the tests known to fail, so only a build system error must fail the job.
       run: |
-        # Without this, `tee` masks the exit status of `y.sh test`.
+        bash <<-EOF
         set -o pipefail
         status=0
-        ${{ matrix.libgccjit_version.env_extra }} ./y.sh test --release --clean --build-sysroot --test-failing-rustc ${{ matrix.libgccjit_version.extra }} 2>&1 | tee output_log || status=$?
-        # This suite runs the tests known to fail, so only a build system error must fail the job.
+        ${LIBGCCJIT_ENV_EXTRA} ./y.sh test --release --clean --build-sysroot --test-failing-rustc ${LIBGCCJIT_EXTRA} 2>&1 | tee output_log || status=$?
         if [ "$status" -ne 0 ] && [ "$status" -ne 2 ]; then
           exit "$status"
         fi
         rg --text "test result" output_log >> $GITHUB_STEP_SUMMARY
+        EOF
+      env:
+        LIBGCCJIT_EXTRA: ${{ matrix.libgccjit_version.extra }}
+        LIBGCCJIT_ENV_EXTRA: ${{ matrix.libgccjit_version.env_extra }}
 
     - name: Run failing ui pattern tests for ICE
       # FIXME: re-enable those tests for libgccjit 12.
       if: matrix.libgccjit_version.gcc != 'libgccjit12.so'
       id: ui-tests
+      # Without `set -o pipefail`, `tee` masks the exit status of `y.sh test`.
+      # This suite runs tests that fail, so only a build system error must fail the job here.
       run: |
-        # Without this, `tee` masks the exit status of `y.sh test`.
+        bash <<-EOF
         set -o pipefail
         status=0
-        ${{ matrix.libgccjit_version.env_extra }} ./y.sh test --release --test-failing-ui-pattern-tests ${{ matrix.libgccjit_version.extra }} 2>&1 | tee output_log_ui || status=$?
-        # This suite runs tests that fail, so only a build system error must fail the job here.
+        ${LIBGCCJIT_ENV_EXTRA} ./y.sh test --release --test-failing-ui-pattern-tests ${LIBGCCJIT_EXTRA} 2>&1 | tee output_log_ui || status=$?
         if [ "$status" -ne 0 ] && [ "$status" -ne 2 ]; then
           exit "$status"
         fi
@@ -136,6 +144,10 @@ jobs:
           echo "Error: 'the compiler unexpectedly panicked' found in output logs. CI Error!!"
           exit 1
         fi
+        EOF
+      env:
+        LIBGCCJIT_EXTRA: ${{ matrix.libgccjit_version.extra }}
+        LIBGCCJIT_ENV_EXTRA: ${{ matrix.libgccjit_version.env_extra }}
 
   # Summary job for the merge queue.
   # ALL THE PREVIOUS JOBS NEED TO BE ADDED TO THE `needs` SECTION OF THIS JOB!
@@ -152,6 +164,8 @@ jobs:
       - name: Conclusion
         run: |
           # Print the dependent jobs to see them in the CI log
-          jq -C <<< '${{ toJson(needs) }}'
+          jq -C <<< "${NEEDS_JSON}"
           # Check if all jobs that we depend on (in the needs array) were successful.
-          jq --exit-status 'all(.result == "success")' <<< '${{ toJson(needs) }}'
+          jq --exit-status 'all(.result == "success")' <<< "${NEEDS_JSON}"
+        env:
+          NEEDS_JSON: ${{ toJson(needs) }}
diff --git a/.github/workflows/gcc12.yml b/.github/workflows/gcc12.yml
index 49db90c638b..ab48f428feb 100644
--- a/.github/workflows/gcc12.yml
+++ b/.github/workflows/gcc12.yml
@@ -37,17 +37,19 @@ jobs:
         ]
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     # `rustup show` installs from rust-toolchain.toml
     - name: Setup rust toolchain
       run: rustup show
 
     - name: Setup rust cache
-      uses: Swatinem/rust-cache@v2
+      uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
 
     - name: Add apt mirrors
-      uses: ./.github/actions/apt-mirrors
+      uses: $/.github/actions/apt-mirrors
 
     - name: Install packages
       # `llvm-tools` is needed to install the `FileCheck` binary which is used for asm tests.
@@ -105,6 +107,8 @@ jobs:
       - name: Conclusion
         run: |
           # Print the dependent jobs to see them in the CI log
-          jq -C <<< '${{ toJson(needs) }}'
+          jq -C <<< "${NEEDS_JSON}"
           # Check if all jobs that we depend on (in the needs array) were successful.
-          jq --exit-status 'all(.result == "success")' <<< '${{ toJson(needs) }}'
+          jq --exit-status 'all(.result == "success")' <<< "${NEEDS_JSON}"
+        env:
+          NEEDS_JSON: ${{ toJson(needs) }}
diff --git a/.github/workflows/m68k.yml b/.github/workflows/m68k.yml
index 0a082c21deb..1e07985cc3b 100644
--- a/.github/workflows/m68k.yml
+++ b/.github/workflows/m68k.yml
@@ -34,17 +34,19 @@ jobs:
         ]
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     # `rustup show` installs from rust-toolchain.toml
     - name: Setup rust toolchain
       run: rustup show
 
     - name: Setup rust cache
-      uses: Swatinem/rust-cache@v2
+      uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
 
     - name: Add apt mirrors
-      uses: ./.github/actions/apt-mirrors
+      uses: $/.github/actions/apt-mirrors
 
     - name: Install packages
       timeout-minutes: 20
@@ -85,9 +87,11 @@ jobs:
     - name: Build sample project with target defined as JSON spec
       run: |
         ./y.sh prepare --only-libcore --cross
-        ./y.sh build --sysroot --target-triple m68k-unknown-linux-gnu --target ${{ github.workspace }}/target_specs/m68k-unknown-linux-gnu.json
-        CARGO_PROFILE_DEV_LTO=no CG_RUSTFLAGS="-Clinker=m68k-unknown-linux-gnu-gcc" ./y.sh cargo build -Zjson-target-spec --manifest-path=./tests/hello-world/Cargo.toml --target ${{ github.workspace }}/target_specs/m68k-unknown-linux-gnu.json
+        ./y.sh build --sysroot --target-triple m68k-unknown-linux-gnu --target ${GH_WORKSPACE}/target_specs/m68k-unknown-linux-gnu.json
+        CARGO_PROFILE_DEV_LTO=no CG_RUSTFLAGS="-Clinker=m68k-unknown-linux-gnu-gcc" ./y.sh cargo build -Zjson-target-spec --manifest-path=./tests/hello-world/Cargo.toml --target ${GH_WORKSPACE}/target_specs/m68k-unknown-linux-gnu.json
         ./y.sh clean all
+      env:
+        GH_WORKSPACE: ${{ github.workspace }}
 
     - name: Build
       run: |
@@ -105,7 +109,9 @@ jobs:
 
     - name: Run tests
       run: |
-        ./y.sh test --target-triple m68k-unknown-linux-gnu --release --clean --build-sysroot ${{ matrix.commands }}
+        ./y.sh test --target-triple m68k-unknown-linux-gnu --release --clean --build-sysroot ${MATRIX_COMMANDS}
+      env:
+        MATRIX_COMMANDS: ${{ matrix.commands }}
 
     - name: Run Hello World!
       run: |
@@ -134,6 +140,8 @@ jobs:
       - name: Conclusion
         run: |
           # Print the dependent jobs to see them in the CI log
-          jq -C <<< '${{ toJson(needs) }}'
+          jq -C <<< "${NEEDS_JSON}"
           # Check if all jobs that we depend on (in the needs array) were successful.
-          jq --exit-status 'all(.result == "success")' <<< '${{ toJson(needs) }}'
+          jq --exit-status 'all(.result == "success")' <<< "${NEEDS_JSON}"
+        env:
+          NEEDS_JSON: ${{ toJson(needs) }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index cc91ea2b666..f1f342de0a0 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -30,17 +30,19 @@ jobs:
         ]
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     # `rustup show` installs from rust-toolchain.toml
     - name: Setup rust toolchain
       run: rustup show
 
     - name: Setup rust cache
-      uses: Swatinem/rust-cache@v2
+      uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
 
     - name: Add apt mirrors
-      uses: ./.github/actions/apt-mirrors
+      uses: $/.github/actions/apt-mirrors
 
     - name: Install packages
       # `llvm-tools` is needed to install the `FileCheck` binary which is used for run-make tests.
@@ -84,12 +86,14 @@ jobs:
       run: cat tests/failing-lto-tests.txt >> tests/failing-ui-tests.txt
 
     - name: Check out rust-lang/rust
-      uses: ./.github/actions/checkout-rust
+      uses: $/.github/actions/checkout-rust
 
     - name: Run tests
       run: |
         # FIXME(antoyo): we cannot enable LTO for stdarch tests currently because of some failing LTO tests using proc-macros.
-        CG_RUSTFLAGS="-Cembed-bitcode=yes" ./y.sh test --release --clean --release-sysroot --build-sysroot --keep-lto-tests ${{ matrix.commands }}
+        CG_RUSTFLAGS="-Cembed-bitcode=yes" ./y.sh test --release --clean --release-sysroot --build-sysroot --keep-lto-tests ${MATRIX_COMMANDS}
+      env:
+        MATRIX_COMMANDS: ${{ matrix.commands }}
 
     - name: LTO test
       run: |
@@ -131,6 +135,8 @@ jobs:
       - name: Conclusion
         run: |
           # Print the dependent jobs to see them in the CI log
-          jq -C <<< '${{ toJson(needs) }}'
+          jq -C <<< "${NEEDS_JSON}"
           # Check if all jobs that we depend on (in the needs array) were successful.
-          jq --exit-status 'all(.result == "success")' <<< '${{ toJson(needs) }}'
+          jq --exit-status 'all(.result == "success")' <<< "${NEEDS_JSON}"
+        env:
+          NEEDS_JSON: ${{ toJson(needs) }}
diff --git a/.github/workflows/rustup.yml b/.github/workflows/rustup.yml
index 13fb592fc2b..91b0b0a5cca 100644
--- a/.github/workflows/rustup.yml
+++ b/.github/workflows/rustup.yml
@@ -49,18 +49,19 @@ jobs:
             run_cargo_tests: true
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         sparse-checkout: .github
         sparse-checkout-cone-mode: false
+        persist-credentials: false
 
     - name: Use the cg_gcc distributed by rustup
-      uses: ./.github/actions/rustup-cg-gcc
+      uses: $/.github/actions/rustup-cg-gcc
       with:
         path: rust
 
     - name: Add apt mirrors
-      uses: ./.github/actions/apt-mirrors
+      uses: $/.github/actions/apt-mirrors
 
     - name: Install packages
       # `llvm-tools` is needed to install the `FileCheck` binary which is used for asm tests.
@@ -101,7 +102,7 @@ jobs:
         ./y.sh clean all
 
     - name: Remove rustc-dev
-      uses: ./.github/actions/remove-rustc-dev
+      uses: $/.github/actions/remove-rustc-dev
       with:
         directory: rust/compiler/rustc_codegen_gcc
 
@@ -113,13 +114,15 @@ jobs:
 
     - name: Check out rust-lang/rust
       if: ${{ contains(matrix.commands, '-rustc') }}
-      uses: ./.github/actions/checkout-rust
+      uses: $/.github/actions/checkout-rust
       with:
         path: rust/compiler/rustc_codegen_gcc
 
     - name: Run tests
       run: |
-        ./y.sh test --release --clean --build-sysroot --no-builtins-tests ${{ matrix.commands }}
+        ./y.sh test --release --clean --build-sysroot --no-builtins-tests ${MATRIX_COMMANDS}
+      env:
+        MATRIX_COMMANDS: ${{ matrix.commands }}
 
   # FIXME: test LTO, based on release.yml, once rustup distributes liblto_plugin.so and lto1
   # (and cg_gcc can find them in the sysroot).
@@ -138,13 +141,14 @@ jobs:
         ]
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         sparse-checkout: .github
         sparse-checkout-cone-mode: false
+        persist-credentials: false
 
     - name: Use the cg_gcc distributed by rustup
-      uses: ./.github/actions/rustup-cg-gcc
+      uses: $/.github/actions/rustup-cg-gcc
       with:
         path: rust
 
@@ -153,7 +157,7 @@ jobs:
       run: rustup component add rustfmt
 
     - name: Add apt mirrors
-      uses: ./.github/actions/apt-mirrors
+      uses: $/.github/actions/apt-mirrors
 
     - name: Install packages
       timeout-minutes: 20
@@ -199,7 +203,7 @@ jobs:
         ./y.sh test --cargo-tests
 
     - name: Remove rustc-dev
-      uses: ./.github/actions/remove-rustc-dev
+      uses: $/.github/actions/remove-rustc-dev
       with:
         directory: rust/compiler/rustc_codegen_gcc
 
@@ -216,7 +220,9 @@ jobs:
         # FIXME: these tests fail when the sysroot is compiled with LTO because of a missing symbol in proc-macro.
         # FIXME: remove --skip test_tile_ and --skip --skip test__tile when it's implemented.
         # FIXME: remove --skip test_mm_srav_epi64 when it's fixed upstream.
-        STDARCH_TEST_SKIP_FUNCTION="xsave,xsaveopt,xsave64,xsaveopt64" STDARCH_TEST_EVERYTHING=1 CHANNEL=release CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_RUNNER="${{ matrix.cargo_runner }}" TARGET=x86_64-unknown-linux-gnu CG_RUSTFLAGS="-Ainternal_features" ./y.sh cargo test --manifest-path build/build_sysroot/sysroot_src/library/stdarch/Cargo.toml -- --skip rtm --skip tbm --skip sse4a --skip test_tile_ --skip test__tile --skip test_mm_srav_epi64
+        STDARCH_TEST_SKIP_FUNCTION="xsave,xsaveopt,xsave64,xsaveopt64" STDARCH_TEST_EVERYTHING=1 CHANNEL=release CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_RUNNER="${MATRIX_CARGO_RUNNER}" TARGET=x86_64-unknown-linux-gnu CG_RUSTFLAGS="-Ainternal_features" ./y.sh cargo test --manifest-path build/build_sysroot/sysroot_src/library/stdarch/Cargo.toml -- --skip rtm --skip tbm --skip sse4a --skip test_tile_ --skip test__tile --skip test_mm_srav_epi64
+      env:
+        MATRIX_CARGO_RUNNER: ${{ matrix.cargo_runner }}
 
   failures:
     runs-on: ubuntu-26.04
@@ -224,23 +230,24 @@ jobs:
     timeout-minutes: 90
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         sparse-checkout: .github
         sparse-checkout-cone-mode: false
+        persist-credentials: false
 
     - name: Use the cg_gcc distributed by rustup
-      uses: ./.github/actions/rustup-cg-gcc
+      uses: $/.github/actions/rustup-cg-gcc
       with:
         path: rust
 
     - name: Remove rustc-dev
-      uses: ./.github/actions/remove-rustc-dev
+      uses: $/.github/actions/remove-rustc-dev
       with:
         directory: rust/compiler/rustc_codegen_gcc
 
     - name: Add apt mirrors
-      uses: ./.github/actions/apt-mirrors
+      uses: $/.github/actions/apt-mirrors
 
     - name: Install packages
       timeout-minutes: 20
@@ -259,7 +266,7 @@ jobs:
         ./y.sh prepare
 
     - name: Check out rust-lang/rust
-      uses: ./.github/actions/checkout-rust
+      uses: $/.github/actions/checkout-rust
       with:
         path: rust/compiler/rustc_codegen_gcc
 
diff --git a/.github/workflows/stdarch.yml b/.github/workflows/stdarch.yml
index 724641d0ef8..aee0239bd8b 100644
--- a/.github/workflows/stdarch.yml
+++ b/.github/workflows/stdarch.yml
@@ -28,7 +28,9 @@ jobs:
         ]
 
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      with:
+        persist-credentials: false
 
     # `rustup show` installs from rust-toolchain.toml
     - name: Setup rust toolchain
@@ -39,10 +41,10 @@ jobs:
       run: rustup component add rustfmt
 
     - name: Setup rust cache
-      uses: Swatinem/rust-cache@v2
+      uses: Swatinem/rust-cache@d1527c8f67ef9af357290475d4af4b0fab8f12e0 # v2.9.3
 
     - name: Add apt mirrors
-      uses: ./.github/actions/apt-mirrors
+      uses: $/.github/actions/apt-mirrors
 
     - name: Install packages
       timeout-minutes: 20
@@ -104,7 +106,9 @@ jobs:
         # FIXME: these tests fail when the sysroot is compiled with LTO because of a missing symbol in proc-macro.
         # FIXME: remove --skip test_tile_ and --skip --skip test__tile when it's implemented.
         # FIXME: remove --skip test_mm_srav_epi64 when it's fixed upstream.
-        STDARCH_TEST_SKIP_FUNCTION="xsave,xsaveopt,xsave64,xsaveopt64" STDARCH_TEST_EVERYTHING=1 CHANNEL=release CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_RUNNER="${{ matrix.cargo_runner }}" TARGET=x86_64-unknown-linux-gnu CG_RUSTFLAGS="-Ainternal_features" ./y.sh cargo test --manifest-path build/build_sysroot/sysroot_src/library/stdarch/Cargo.toml -- --skip rtm --skip tbm --skip sse4a --skip test_tile_ --skip test__tile --skip test_mm_srav_epi64
+        STDARCH_TEST_SKIP_FUNCTION="xsave,xsaveopt,xsave64,xsaveopt64" STDARCH_TEST_EVERYTHING=1 CHANNEL=release CARGO_TARGET_X86_64_UNKNOWN_LINUX_GNU_RUNNER="${MATRIX_CARGO_RUNNER}" TARGET=x86_64-unknown-linux-gnu CG_RUSTFLAGS="-Ainternal_features" ./y.sh cargo test --manifest-path build/build_sysroot/sysroot_src/library/stdarch/Cargo.toml -- --skip rtm --skip tbm --skip sse4a --skip test_tile_ --skip test__tile --skip test_mm_srav_epi64
+      env:
+        MATRIX_CARGO_RUNNER: ${{ matrix.cargo_runner }}
 
   # Summary job for the merge queue.
   # ALL THE PREVIOUS JOBS NEED TO BE ADDED TO THE `needs` SECTION OF THIS JOB!
@@ -121,6 +125,8 @@ jobs:
       - name: Conclusion
         run: |
           # Print the dependent jobs to see them in the CI log
-          jq -C <<< '${{ toJson(needs) }}'
+          jq -C <<< "${NEEDS_JSON}"
           # Check if all jobs that we depend on (in the needs array) were successful.
-          jq --exit-status 'all(.result == "success")' <<< '${{ toJson(needs) }}'
+          jq --exit-status 'all(.result == "success")' <<< "${NEEDS_JSON}"
+        env:
+          NEEDS_JSON: ${{ toJson(needs) }}