diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml
index 562bc8ca3..7a0b52351 100644
--- a/.github/workflows/ci-cd.yml
+++ b/.github/workflows/ci-cd.yml
@@ -26,12 +26,12 @@ jobs:
     name: Test
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-tags: true
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '20'
 
@@ -171,10 +171,10 @@ jobs:
     name: Test core-domain
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '20'
           cache: 'npm'
@@ -231,10 +231,10 @@ jobs:
     name: Test core
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '20'
           cache: 'npm'
@@ -250,10 +250,10 @@ jobs:
     name: Test mcp-server
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '20'
           cache: 'npm'
@@ -322,10 +322,10 @@ jobs:
     name: Test core-api
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '20'
           cache: 'npm'
@@ -359,9 +359,9 @@ jobs:
     name: Test sdk-client
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '20'
           cache: 'npm'
@@ -384,9 +384,9 @@ jobs:
     name: Test contract (SDK wire fidelity)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '20'
           cache: 'npm'
@@ -425,9 +425,9 @@ jobs:
     name: Test infra-providers
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '20'
           cache: 'npm'
@@ -452,9 +452,9 @@ jobs:
     name: Test agent-runtime
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '20'
           cache: 'npm'
@@ -472,9 +472,9 @@ jobs:
     name: Test agent-runtime-api
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '20'
           cache: 'npm'
@@ -493,9 +493,9 @@ jobs:
     name: Test contracts
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '20'
           cache: 'npm'
@@ -526,9 +526,9 @@ jobs:
     name: Governance guards (GT-578)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '20'
           cache: 'npm'
@@ -904,21 +904,21 @@ jobs:
             dockerfile: ./src/apps/agent-runtime-api/Dockerfile
             image: evolith-agent-runtime
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@37fe631027851001ddb9b187196cc803df7f5f0e # v4.3.0
 
       - name: Login to GHCR
         if: env.PUBLISH == 'true'
-        uses: docker/login-action@v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build ${{ matrix.service }} (push only from main/tags)
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: ${{ matrix.context }}
           file: ${{ matrix.dockerfile }}
diff --git a/.github/workflows/coverage-impact.yml b/.github/workflows/coverage-impact.yml
index bb69b8687..8c92a8f58 100644
--- a/.github/workflows/coverage-impact.yml
+++ b/.github/workflows/coverage-impact.yml
@@ -18,12 +18,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "20"
 
@@ -68,7 +68,7 @@ jobs:
           echo "coverage=$COVERAGE" >> $GITHUB_OUTPUT
 
       - name: Post coverage comment
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const { pairs_modified, new_need_es, total_en, total_es, paired, coverage } = ${{ toJSON(steps.analyze.outputs) }};
diff --git a/.github/workflows/docker-images.yml b/.github/workflows/docker-images.yml
index 65db4d338..257c6ec78 100644
--- a/.github/workflows/docker-images.yml
+++ b/.github/workflows/docker-images.yml
@@ -37,10 +37,10 @@ jobs:
             dockerfile: src/packages/mcp-server/Dockerfile
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Log in to GHCR
-        uses: docker/login-action@v4
+        uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -48,7 +48,7 @@ jobs:
 
       - name: Compute tags
         id: meta
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
         with:
           images: ghcr.io/${{ github.repository_owner }}/${{ matrix.name }}
           # `type=ref,event=tag` publishes the git tag VERBATIM — `v1.1.0`, with
@@ -67,10 +67,10 @@ jobs:
             type=raw,value=latest,enable=${{ github.ref_type == 'tag' }}
 
       - name: Set up Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           # Build context is the repository root for all services (the Dockerfiles
           # COPY repo-relative paths; agent-runtime builds the workspace packages).
diff --git a/.github/workflows/docs-release.yml b/.github/workflows/docs-release.yml
index af0516dad..d4ae3d9a8 100644
--- a/.github/workflows/docs-release.yml
+++ b/.github/workflows/docs-release.yml
@@ -21,7 +21,7 @@ jobs:
       version: ${{ steps.extract.outputs.version }}
       branch: ${{ steps.extract.outputs.branch }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-tags: true
 
@@ -60,12 +60,12 @@ jobs:
     if: needs.release-trigger-check.outputs.version != ''
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
       - name: Setup Node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '20'
 
@@ -94,7 +94,7 @@ jobs:
     if: needs.release-trigger-check.outputs.version != ''
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
@@ -106,7 +106,7 @@ jobs:
           git push origin $VERSION
 
       - name: Create GitHub Release
-        uses: actions/create-release@v1
+        uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1.1.4
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           VERSION: ${{ needs.release-trigger-check.outputs.version }}
@@ -136,10 +136,10 @@ jobs:
     if: github.ref != 'refs/heads/main'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '20'
           cache: 'npm'
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 9661818c5..3dea2f422 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -25,12 +25,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "20"
 
@@ -56,12 +56,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: "20"
           cache: 'npm'
@@ -356,7 +356,7 @@ jobs:
           node --test .harness/scripts/lib/generated-doc-exclusions.test.mjs
 
       - name: Upload coverage report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: github.event_name == 'workflow_dispatch'
         with:
           name: coverage-report
diff --git a/.github/workflows/enforce-root-cleanliness.yml b/.github/workflows/enforce-root-cleanliness.yml
index 6dc8a6c4b..81d393f5f 100644
--- a/.github/workflows/enforce-root-cleanliness.yml
+++ b/.github/workflows/enforce-root-cleanliness.yml
@@ -17,10 +17,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '20'
 
diff --git a/.github/workflows/evolith-validate-dogfood.yml b/.github/workflows/evolith-validate-dogfood.yml
index 43d30eb77..2bb71a4d9 100644
--- a/.github/workflows/evolith-validate-dogfood.yml
+++ b/.github/workflows/evolith-validate-dogfood.yml
@@ -60,10 +60,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: 'npm'
@@ -83,10 +83,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: 'npm'
@@ -172,7 +172,7 @@ jobs:
 
       - name: Upload the dogfood compliance report
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: evolith-validate-dogfood-report
           path: ${{ steps.report.outputs.report-path }}
diff --git a/.github/workflows/knowledge-intake.yml b/.github/workflows/knowledge-intake.yml
index 9ac6db9e4..e3a2b7803 100644
--- a/.github/workflows/knowledge-intake.yml
+++ b/.github/workflows/knowledge-intake.yml
@@ -30,12 +30,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: 'npm'
@@ -92,12 +92,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: 'npm'
@@ -150,10 +150,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Post PR Comment
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const validateResult = '${{ needs.validate.result }}';
diff --git a/.github/workflows/npm-release.yml b/.github/workflows/npm-release.yml
index e26a6cca4..fc4020424 100644
--- a/.github/workflows/npm-release.yml
+++ b/.github/workflows/npm-release.yml
@@ -57,10 +57,10 @@ jobs:
     name: Publish workspaces
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           registry-url: 'https://registry.npmjs.org'
@@ -292,7 +292,7 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5.1.0
 
       - name: Install mcp-publisher
         run: |
diff --git a/.github/workflows/opa-parity.yml b/.github/workflows/opa-parity.yml
index b1cca8c7d..128e87df6 100644
--- a/.github/workflows/opa-parity.yml
+++ b/.github/workflows/opa-parity.yml
@@ -22,12 +22,12 @@ jobs:
     name: Native/OPA Semantic Parity (full)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-node@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '20'
       - name: Install dependencies
-        run: npm install --legacy-peer-deps
+        run: npm ci --legacy-peer-deps
       - name: Compile OPA policies to WASM (pinned opa)
         run: npm run build:policy
       - name: Run full Native/OPA parity gate
diff --git a/.github/workflows/published-canary.yml b/.github/workflows/published-canary.yml
index 2cd375db6..d86e6021c 100644
--- a/.github/workflows/published-canary.yml
+++ b/.github/workflows/published-canary.yml
@@ -46,9 +46,9 @@ jobs:
       # under test: the packages are installed into a throwaway prefix and driven
       # from a temp directory, which is the whole point — GT-625 shipped an
       # uninstallable CLI precisely because the workspace symlink hid it.
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '20'
 
@@ -67,7 +67,7 @@ jobs:
       # duplicated, so a week of red is one thread and not seven.
       - name: Open or update the canary issue
         if: failure() && github.event_name == 'schedule'
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const fs = require('fs');
@@ -106,7 +106,7 @@ jobs:
       # healthy again the thread says so and closes itself.
       - name: Close the canary issue when the registry is healthy again
         if: success() && github.event_name == 'schedule'
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7.1.0
         with:
           script: |
             const existing = await github.rest.issues.listForRepo({
diff --git a/.github/workflows/rag-index-sync.yml b/.github/workflows/rag-index-sync.yml
index 03beb99ee..c0f2cf989 100644
--- a/.github/workflows/rag-index-sync.yml
+++ b/.github/workflows/rag-index-sync.yml
@@ -26,11 +26,11 @@ jobs:
     name: Delta re-embed changed reference/ chunks
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
         with:
           fetch-depth: 2 # HEAD~1..HEAD delta
 
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '22'
 
@@ -48,7 +48,7 @@ jobs:
 
       - name: Upload sync receipt
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: rag-sync-receipt
           path: rag-sync-receipt.json
diff --git a/.github/workflows/reliability.yml b/.github/workflows/reliability.yml
index 088cb0978..f10e17c0e 100644
--- a/.github/workflows/reliability.yml
+++ b/.github/workflows/reliability.yml
@@ -84,10 +84,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 25
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '20'
 
@@ -107,7 +107,7 @@ jobs:
         run: npm run build:policy
 
       - name: Install k6
-        uses: grafana/setup-k6-action@v1
+        uses: grafana/setup-k6-action@db07bd9765aac508ef18982e52ab937fe633a065 # v1.2.1
 
       # THROTTLE_MAX_REQUESTS is raised deliberately. core-api throttles every
       # route at 100 requests / 60 s by default, so ANY real load run against a
@@ -173,7 +173,7 @@ jobs:
 
       - name: Upload k6 summaries and server log
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: k6-reliability-${{ github.run_id }}
           path: |
@@ -194,15 +194,15 @@ jobs:
     # and up repeatedly, which is a poor fit for per-PR feedback.
     if: github.event_name != 'pull_request'
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: '20'
 
       - name: Install k6
-        uses: grafana/setup-k6-action@v1
+        uses: grafana/setup-k6-action@db07bd9765aac508ef18982e52ab937fe633a065 # v1.2.1
 
       # Engine-only topology: core-api + mcp + redis. The full-stack file is NOT
       # usable here — it has cross-repo build contexts (the Tracker checked out
@@ -362,7 +362,7 @@ jobs:
 
       - name: Upload chaos logs
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: chaos-reliability-${{ github.run_id }}
           path: ${{ runner.temp }}/chaos-*.log
diff --git a/.github/workflows/sdk-cli-ci.yml b/.github/workflows/sdk-cli-ci.yml
index 1bafd3eb7..35c6ba213 100644
--- a/.github/workflows/sdk-cli-ci.yml
+++ b/.github/workflows/sdk-cli-ci.yml
@@ -59,12 +59,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: 'npm'
@@ -96,10 +96,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
@@ -149,10 +149,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: 'npm'
@@ -192,10 +192,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: 'npm'
@@ -222,7 +222,7 @@ jobs:
         run: npm run test:cov -- --coverageReporters=text-summary --coverageReporters=json-summary
 
       - name: Upload Coverage
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: coverage-report
           path: ${{ env.CLI_DIR }}/coverage/
@@ -245,12 +245,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
@@ -294,10 +294,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
@@ -361,10 +361,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
@@ -413,19 +413,19 @@ jobs:
       contents: read
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4.37.9
+        uses: github/codeql-action/init@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           languages: javascript-typescript
           queries: security-and-quality
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v4.37.9
+        uses: github/codeql-action/autobuild@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4.37.9
+        uses: github/codeql-action/analyze@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           category: "/language:javascript-typescript"
 
@@ -440,10 +440,10 @@ jobs:
       contents: read
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Run Trivy Vulnerability Scanner
-        uses: aquasecurity/trivy-action@v0.36.0
+        uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
         with:
           scan-type: 'fs'
           scan-ref: '.'
@@ -452,7 +452,7 @@ jobs:
           severity: 'CRITICAL,HIGH'
 
       - name: Upload Trivy SARIF Report
-        uses: github/codeql-action/upload-sarif@v4.37.9
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         if: always()
         with:
           sarif_file: 'trivy-results.sarif'
@@ -486,7 +486,7 @@ jobs:
       # pack and stays compromised, but that is history remediation, a separate
       # piece of work, not something a pull request can satisfy.
       - name: Checkout Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install gitleaks
         run: |
@@ -503,7 +503,7 @@ jobs:
       # a leak in the tree should be reported before three minutes of install,
       # and `node_modules` is not part of what gets scanned either way.
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: 'npm'
@@ -528,10 +528,10 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 2
-      - uses: actions/setup-node@v7
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
       - name: Install dependencies
@@ -559,10 +559,10 @@ jobs:
     continue-on-error: true
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: 'npm'
@@ -611,7 +611,7 @@ jobs:
         # failed with "The artifact name zap_scan is not valid" -- after a clean
         # scan (FAIL-NEW: 0, WARN-NEW: 1, PASS: 146). v0.12.0 stopped using the
         # deprecated version; this pins the current release.
-        uses: zaproxy/action-full-scan@v0.13.0
+        uses: zaproxy/action-full-scan@3c58388149901b9a03b7718852c5ba889646c27c # v0.13.0
         with:
           target: 'http://localhost:3001'
           cmd_options: '-a'
@@ -625,7 +625,7 @@ jobs:
           allow_issue_writing: false
 
       - name: Upload ZAP Report
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         if: always()
         with:
           name: zap-report
diff --git a/.github/workflows/sdk-cli-release.yml b/.github/workflows/sdk-cli-release.yml
index eed870c84..b5f7c87c7 100644
--- a/.github/workflows/sdk-cli-release.yml
+++ b/.github/workflows/sdk-cli-release.yml
@@ -84,12 +84,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           cache: 'npm'
@@ -130,7 +130,7 @@ jobs:
       version: ${{ steps.gate.outputs.version }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Resolve release intent
         id: gate
@@ -232,12 +232,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           registry-url: 'https://registry.npmjs.org'
@@ -300,9 +300,16 @@ jobs:
         working-directory: ${{ env.CLI_DIR }}
         run: npm run build
 
+      # Same gate as `Security Audit` in sdk-cli-ci.yml, for the same reason (GT-657):
+      # a raw `npm audit --audit-level=high` cannot express an advisory that no
+      # override can reach, so the day one lands this job turns permanently red —
+      # the failure mode GT-622 removed, where a check that is always red trains
+      # reviewers to discount red. The gate keeps the HIGH threshold and audits the
+      # whole root lockfile (the CLI's tree is a subset of it); what it adds is that
+      # such an advisory must be NAMED in .harness/config/npm-audit-exceptions.json
+      # with the path it arrives by, and it turns red again when the entry goes stale.
       - name: Security Audit
-        working-directory: ${{ env.CLI_DIR }}
-        run: npm audit --audit-level=high
+        run: node .harness/scripts/ci/63-validate-npm-audit-gate.mjs --verbose
 
       - name: Unit Tests (MUST PASS)
         working-directory: ${{ env.CLI_DIR }}
@@ -342,10 +349,10 @@ jobs:
       id-token: write
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
           registry-url: 'https://registry.npmjs.org'
@@ -462,10 +469,10 @@ jobs:
             ext: '.exe'
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Setup Node.js
-        uses: actions/setup-node@v7
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ env.NODE_VERSION }}
 
@@ -525,7 +532,7 @@ jobs:
           ls -la
 
       - name: Upload Binary Artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: binaries-${{ matrix.target }}
           path: ${{ env.CLI_DIR }}/binaries/evolith-cli-${{ matrix.target }}${{ matrix.ext }}
@@ -553,7 +560,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: Download Binary
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: binaries-${{ matrix.target }}
           path: ./binaries
@@ -583,7 +590,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Download Binary
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: binaries-node20-linux-x64
           path: ./binaries
@@ -624,10 +631,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Download All Binaries
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: binaries-*
           path: ./release-assets
@@ -644,7 +651,7 @@ jobs:
           echo "✅ All $count platform binaries present"
 
       - name: Upload to Release
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           # `tag_name` is a `cli-v*` tag, so this Release is the CLI's own and the
           # `name`/`body` below overwrite nothing hand-written. On a `v*` tag they
@@ -712,7 +719,7 @@ jobs:
       # not on routine pushes where no release was created (avoids issue spam).
       - name: Create Issue on Failure
         if: ${{ github.event_name == 'push' && needs.release-gate.outputs.release_created == 'true' }}
-        uses: actions/github-script@v9
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             try {
diff --git a/action.yml b/action.yml
index d50f0e496..e99cd45f4 100644
--- a/action.yml
+++ b/action.yml
@@ -121,7 +121,7 @@ runs:
     # ------------------------------------------------------------------
     - name: Setup Node.js ${{ inputs.node-version }}
       if: ${{ inputs.cli-command == '' }}
-      uses: actions/setup-node@v7
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
         node-version: ${{ inputs.node-version }}
 
diff --git a/package-lock.json b/package-lock.json
index be69ebf7d..7a54533e1 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -8474,9 +8474,9 @@
       "license": "MIT"
     },
     "node_modules/baseline-browser-mapping": {
-      "version": "2.11.21",
-      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.21.tgz",
-      "integrity": "sha512-uh8vpY/1/YyFkunIDFH/12p7/7VdPKA1hejMVEbdkEaWnUz0Hesvx5EbiU6XxjyHZIOju+ZMbQJkRh+es3/spQ==",
+      "version": "2.11.23",
+      "resolved": "https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.11.23.tgz",
+      "integrity": "sha512-le521dGVfxM7yRX0EikCoSz+rOK+hHzdDt/E7mG1jOJB/6WAAUuwVroLwaB7ApaUsz5Q0kFlDXLSA9MheUIfRQ==",
       "dev": true,
       "license": "Apache-2.0",
       "bin": {
@@ -10968,9 +10968,9 @@
       "license": "MIT"
     },
     "node_modules/hono": {
-      "version": "4.12.34",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.34.tgz",
-      "integrity": "sha512-GqXJqY/xJkJmuloTrnV1ZEXG3fqte+VjkUqoRNZXcrUidiUOP4fMSIHHY4tsqZBK++kVyWmt/AAfSUuy57/eSA==",
+      "version": "4.13.7",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.7.tgz",
+      "integrity": "sha512-c8/gF9ac8Y78/agExVocyLevgR+JlpNB444Py0FSX8pJoPdYUfUzRcXtYEYGwt6l19qIlVZPN5Mfsw9jFShmQQ==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"
@@ -13396,17 +13396,20 @@
       "license": "MIT"
     },
     "node_modules/qs": {
-      "version": "6.15.2",
+      "version": "6.16.0",
       "license": "BSD-3-Clause",
       "dependencies": {
-        "side-channel": "^1.1.0"
+        "es-define-property": "^1.0.1",
+        "side-channel": "^1.1.1"
       },
       "engines": {
         "node": ">=0.6"
       },
       "funding": {
         "url": "https://github.com/sponsors/ljharb"
-      }
+      },
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.0.tgz",
+      "integrity": "sha512-h6fhOIaRrID2CbEY2fqs+7t+UXZo+MLAnU5gRIq85uFtdiUPCdsApMlHhXogKVM4HM2DVbIjGNTTYH2OcmP1vA=="
     },
     "node_modules/quick-format-unescaped": {
       "version": "4.0.4",
diff --git a/package.json b/package.json
index 786f57515..c09efc548 100644
--- a/package.json
+++ b/package.json
@@ -45,6 +45,8 @@
       "ajv": "^6.12.6"
     },
     "ip-address": "10.4.0",
-    "hono": "4.12.34"
+    "hono": "4.13.7",
+    "qs": "6.16.0",
+    "baseline-browser-mapping": "2.11.23"
   }
 }
diff --git a/product/infra/docker/bff.Dockerfile b/product/infra/docker/bff.Dockerfile
index fef5bbb94..c4d5e1763 100644
--- a/product/infra/docker/bff.Dockerfile
+++ b/product/infra/docker/bff.Dockerfile
@@ -4,7 +4,7 @@
 # ---------------------------------------------------------
 
 # Stage 1: Dependencies and Build
-FROM node:22-alpine AS builder
+FROM node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32 AS builder
 WORKDIR /app
 
 # Install dependencies for native modules
@@ -17,13 +17,13 @@ COPY . .
 RUN npm run build
 
 # Stage 2: Production Dependencies
-FROM node:22-alpine AS prod-deps
+FROM node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32 AS prod-deps
 WORKDIR /app
 COPY package*.json ./
 RUN npm ci --only=production && npm cache clean --force
 
 # Stage 3: Runtime
-FROM node:22-alpine AS runtime
+FROM node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32 AS runtime
 WORKDIR /app
 
 # Standard Evolith security rules: do not run as root
diff --git a/product/infra/docker/mcp.Dockerfile b/product/infra/docker/mcp.Dockerfile
index 531690caa..a5872d971 100644
--- a/product/infra/docker/mcp.Dockerfile
+++ b/product/infra/docker/mcp.Dockerfile
@@ -3,7 +3,7 @@
 # MCP Server Dockerfile Template (HTTP/SSE Mode)
 # ---------------------------------------------------------
 
-FROM node:22-alpine AS builder
+FROM node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32 AS builder
 WORKDIR /app
 
 COPY package*.json ./
@@ -12,7 +12,7 @@ RUN npm ci
 COPY . .
 RUN npm run build
 
-FROM node:22-alpine AS runtime
+FROM node:22-alpine@sha256:c610fcdfb1d5b4740dd70c284ed3cb16bb857e0f7166196e36a5501df7a3aa32 AS runtime
 WORKDIR /app
 
 RUN addgroup -g 1001 -S evolith && \
diff --git a/src/apps/agent-runtime-api/Dockerfile b/src/apps/agent-runtime-api/Dockerfile
index a05e158b8..49a25b187 100644
--- a/src/apps/agent-runtime-api/Dockerfile
+++ b/src/apps/agent-runtime-api/Dockerfile
@@ -8,7 +8,7 @@
 #   Dockerfile location = src/apps/agent-runtime-api/Dockerfile
 #   Build context / base directory = /  (repository root)
 # ──────────────────────────────────────────────────────────────────────────
-FROM node:20-alpine AS builder
+FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS builder
 
 WORKDIR /repo
 
@@ -95,7 +95,7 @@ RUN test -f src/apps/agent-runtime-api/dist/main.js || { \
 RUN npm prune --omit=dev --legacy-peer-deps
 
 # ── Runner ──────────────────────────────────────────────────────────────────
-FROM node:20-alpine AS runner
+FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS runner
 
 LABEL org.opencontainers.image.title="Evolith Agent Runtime API"
 LABEL org.opencontainers.image.source="https://github.com/beyondnetcode/evolith_arch32"
diff --git a/src/apps/core-api/Dockerfile b/src/apps/core-api/Dockerfile
index 7b65d60ad..180f24159 100644
--- a/src/apps/core-api/Dockerfile
+++ b/src/apps/core-api/Dockerfile
@@ -8,7 +8,7 @@
 # package. This image builds the workspace packages from source instead.
 #   Coolify: Dockerfile = src/apps/core-api/Dockerfile, base directory = /
 # ──────────────────────────────────────────────────────────────────────────
-FROM node:20-alpine AS builder
+FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS builder
 
 WORKDIR /repo
 
@@ -63,7 +63,7 @@ RUN test -f src/apps/core-api/dist/main.js || { \
 RUN npm prune --omit=dev --legacy-peer-deps
 
 # ── Runner ──────────────────────────────────────────────────────────────────
-FROM node:20-alpine AS runner
+FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS runner
 
 LABEL org.opencontainers.image.title="Evolith Core API"
 LABEL org.opencontainers.image.source="https://github.com/beyondnetcode/evolith_arch32"
diff --git a/src/packages/mcp-server/Dockerfile b/src/packages/mcp-server/Dockerfile
index d9649c036..2e3fbed99 100644
--- a/src/packages/mcp-server/Dockerfile
+++ b/src/packages/mcp-server/Dockerfile
@@ -7,7 +7,7 @@
 # (@beyondnet/evolith-core-domain, @beyondnet/evolith-infra-providers, @beyondnet/evolith-core) from source.
 #   Coolify: Dockerfile = src/packages/mcp-server/Dockerfile, base directory = /
 # ──────────────────────────────────────────────────────────────────────────
-FROM node:20-alpine AS builder
+FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS builder
 
 WORKDIR /repo
 
@@ -48,7 +48,7 @@ RUN test -f src/packages/mcp-server/dist/main.js || { \
 RUN npm prune --omit=dev --legacy-peer-deps
 
 # ── Runner ──────────────────────────────────────────────────────────────────
-FROM node:20-alpine AS runner
+FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS runner
 
 LABEL org.opencontainers.image.title="Evolith MCP Server"
 LABEL org.opencontainers.image.source="https://github.com/beyondnetcode/evolith_arch32"
diff --git a/src/packages/mcp-server/src/tools/pattern.tools.ts b/src/packages/mcp-server/src/tools/pattern.tools.ts
index 7e0aba07b..1d52af281 100644
--- a/src/packages/mcp-server/src/tools/pattern.tools.ts
+++ b/src/packages/mcp-server/src/tools/pattern.tools.ts
@@ -1,4 +1,3 @@
-import * as path from 'node:path';
 import { resolveCorePath } from '../mcp/core-path';
 import type { IFileSystem, ILogger } from '@beyondnet/evolith-core';
 import { PatternCatalogService } from '@beyondnet/evolith-core';
diff --git a/src/sdk/cli/Dockerfile b/src/sdk/cli/Dockerfile
index e9e8976a2..be75d9d39 100644
--- a/src/sdk/cli/Dockerfile
+++ b/src/sdk/cli/Dockerfile
@@ -19,7 +19,7 @@
 # This image is the CLI: a governance tool you exec against a mounted
 # satellite workspace, not a long-running server.
 # ──────────────────────────────────────────────────────────────────────────
-FROM node:20-alpine AS builder
+FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS builder
 
 WORKDIR /repo
 
@@ -51,7 +51,7 @@ RUN npx tsc -b tsconfig.json && \
 RUN npm prune --omit=dev --legacy-peer-deps
 
 # ── Runner ──────────────────────────────────────────────────────────────────
-FROM node:20-alpine AS runner
+FROM node:20-alpine@sha256:fb4cd12c85ee03686f6af5362a0b0d56d50c58a04632e6c0fb8363f609372293 AS runner
 
 LABEL org.opencontainers.image.title="Evolith CLI"
 LABEL org.opencontainers.image.description="Evolith CLI — governance, standards validation, and AI agent integration for satellite repositories"
diff --git a/src/sdk/cli/examples/validate-repo.sh b/src/sdk/cli/examples/validate-repo.sh
index c3b29cbcf..c938bd7ca 100644
--- a/src/sdk/cli/examples/validate-repo.sh
+++ b/src/sdk/cli/examples/validate-repo.sh
@@ -20,7 +20,7 @@ echo "=============================================="
 # Check if evolith CLI is available
 if ! command -v evolith &> /dev/null; then
     echo "Installing Evolith CLI..."
-    npm install -g @beyondnet/evolith-cli
+    npm install -g @beyondnet/evolith-cli@1.3.2
 fi
 
 # Run validation