diff --git a/.github/workflows/actionlint.yml b/.github/workflows/actionlint.yml
index 49ae536..761f996 100644
--- a/.github/workflows/actionlint.yml
+++ b/.github/workflows/actionlint.yml
@@ -14,8 +14,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
     - name: actionlint
-      uses: raven-actions/actionlint@v2
+      uses: raven-actions/actionlint@3d39aea434753780c3b3d4a1a31c854b4dbf49d7 # v2
       with:
         pyflakes: false # we do not use python scripts
diff --git a/.github/workflows/functional_tests.yml b/.github/workflows/functional_tests.yml
index 30c937b..bb4480e 100644
--- a/.github/workflows/functional_tests.yml
+++ b/.github/workflows/functional_tests.yml
@@ -39,7 +39,7 @@ jobs:
     outputs:
       toolchain: ${{ steps.resolve.outputs.toolchain }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - name: Resolve the functional test toolchain
         id: resolve
         env:
@@ -67,7 +67,7 @@ jobs:
         # see ./github/functional_tests/lake_init/action.yml for more details on lake-init-arguments
         lake-init-arguments: ["standalone", "mathdep math", "tomltest .toml"]
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/functional_tests/lake_init_success
         with:
           lake-init-arguments: ${{ matrix.lake-init-arguments}}
@@ -77,7 +77,7 @@ jobs:
     needs: resolve-toolchain
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/functional_tests/lake_init_failure
         with:
           toolchain: ${{ needs.resolve-toolchain.outputs.toolchain }}
@@ -86,7 +86,7 @@ jobs:
     needs: resolve-toolchain
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/functional_tests/auto_config_true
         with:
           toolchain: ${{ needs.resolve-toolchain.outputs.toolchain }}
@@ -95,7 +95,7 @@ jobs:
     needs: resolve-toolchain
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/functional_tests/auto_config_false
         with:
           toolchain: ${{ needs.resolve-toolchain.outputs.toolchain }}
@@ -103,7 +103,7 @@ jobs:
   auto-config-false-legacy-leanchecker:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/functional_tests/auto_config_false
         with:
           toolchain: ${{ env.legacy_toolchain }}
@@ -112,7 +112,7 @@ jobs:
     needs: resolve-toolchain
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/functional_tests/lake_build_args
         with:
           toolchain: ${{ needs.resolve-toolchain.outputs.toolchain }}
@@ -121,7 +121,7 @@ jobs:
     needs: resolve-toolchain
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/functional_tests/lake_test_args
         with:
           toolchain: ${{ needs.resolve-toolchain.outputs.toolchain }}
@@ -130,7 +130,7 @@ jobs:
     needs: resolve-toolchain
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/functional_tests/mathlib_dependency
         with:
           toolchain: ${{ needs.resolve-toolchain.outputs.toolchain }}
@@ -139,7 +139,7 @@ jobs:
     needs: resolve-toolchain
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/functional_tests/lake_test_success
         with:
           toolchain: ${{ needs.resolve-toolchain.outputs.toolchain }}
@@ -148,7 +148,7 @@ jobs:
     needs: resolve-toolchain
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/functional_tests/lake_test_failure
         with:
           toolchain: ${{ needs.resolve-toolchain.outputs.toolchain }}
@@ -157,7 +157,7 @@ jobs:
     needs: resolve-toolchain
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/functional_tests/lake_lint_success
         with:
           toolchain: ${{ needs.resolve-toolchain.outputs.toolchain }}
@@ -166,7 +166,7 @@ jobs:
     needs: resolve-toolchain
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/functional_tests/lake_lint_failure
         with:
           toolchain: ${{ needs.resolve-toolchain.outputs.toolchain }}
@@ -175,7 +175,7 @@ jobs:
     needs: resolve-toolchain
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
       - uses: ./.github/functional_tests/lake_lint_args
         with:
           toolchain: ${{ needs.resolve-toolchain.outputs.toolchain }}
@@ -184,7 +184,7 @@ jobs:
     needs: resolve-toolchain
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/functional_tests/lake_check_test_failure
         with:
           toolchain: ${{ needs.resolve-toolchain.outputs.toolchain }}
@@ -193,7 +193,7 @@ jobs:
     needs: resolve-toolchain
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/functional_tests/subdirectory_lake_package
         with:
           toolchain: ${{ needs.resolve-toolchain.outputs.toolchain }}
@@ -201,7 +201,7 @@ jobs:
   subdirectory-lake-package-lean-checker:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/functional_tests/subdirectory_lake_package_lean_checker
         with:
           toolchain: ${{ env.legacy_toolchain }}
@@ -210,7 +210,7 @@ jobs:
     needs: resolve-toolchain
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/functional_tests/reinstall-transient-toolchain
         with:
           toolchain: ${{ needs.resolve-toolchain.outputs.toolchain }}
@@ -219,7 +219,7 @@ jobs:
     needs: resolve-toolchain
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/functional_tests/mk_all-check
         with:
           toolchain: ${{ needs.resolve-toolchain.outputs.toolchain }}
@@ -228,7 +228,7 @@ jobs:
     needs: resolve-toolchain
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/functional_tests/mk_all_args
         with:
           toolchain: ${{ needs.resolve-toolchain.outputs.toolchain }}
@@ -237,7 +237,7 @@ jobs:
     needs: resolve-toolchain
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/functional_tests/axiom_audit
         with:
           # axiom-audit builds with the project's toolchain, so use a recent one.
@@ -247,7 +247,7 @@ jobs:
     needs: resolve-toolchain
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/functional_tests/lake_init_success
         with:
           lake-init-arguments: "standalone"
@@ -257,7 +257,7 @@ jobs:
     needs: resolve-toolchain
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
       - uses: ./.github/functional_tests/lake_init_success
         with:
           lake-init-arguments: "standalone"
diff --git a/.github/workflows/nanoda-daily.yml b/.github/workflows/nanoda-daily.yml
index 60beca8..5865e28 100644
--- a/.github/workflows/nanoda-daily.yml
+++ b/.github/workflows/nanoda-daily.yml
@@ -51,18 +51,18 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Run lean-action with nanoda
         id: lean-action
-        uses: leanprover/lean-action@v1
+        uses: leanprover/lean-action@50fcf42d2e460296f1a34b402e990d1b24f8b596 # v1
         with:
           nanoda: true
           nanoda-allow-sorry: ${{ inputs.allow-sorry }}
 
       - name: Create GitHub issue on failure
         if: failure() && inputs.notify == 'issue'
-        uses: actions/github-script@v7
+        uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
         with:
           script: |
             const runUrl = `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`;
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index f7df944..966d8c8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -33,7 +33,7 @@ jobs:
       major: ${{ steps.validate.outputs.major }}
       new-major: ${{ steps.validate.outputs.new-major }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Validate the release version
         id: validate
@@ -74,7 +74,7 @@ jobs:
     needs: [validate, functional-tests]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Create the GitHub release
         env:
@@ -114,7 +114,7 @@ jobs:
     needs: [validate, release]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Stamp CHANGELOG.md with the release version and date
         env:
@@ -133,7 +133,7 @@ jobs:
           sed -i "s#leanprover/lean-action@$previous_major#leanprover/lean-action@$major#g" README.md
 
       - name: Create pull request
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
         with:
           token: ${{ secrets.TOOLCHAIN_UPDATE_TOKEN || github.token }}
           commit-message: "chore: finalize ${{ inputs.version }} release"
diff --git a/.github/workflows/shellcheck.yml b/.github/workflows/shellcheck.yml
index e3cfbd8..39974bb 100644
--- a/.github/workflows/shellcheck.yml
+++ b/.github/workflows/shellcheck.yml
@@ -10,6 +10,6 @@ jobs:
       runs-on: ubuntu-latest
       steps:
         - name: Checkout code
-          uses: actions/checkout@v7
+          uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         - name: Run ShellCheck
-          uses: azohra/shell-linter@v0.8.0
+          uses: azohra/shell-linter@30a9cf3f6cf25c08fc98f10d7dc4167f7b5c0c00 # v0.8.0
diff --git a/.github/workflows/update_functional_test_toolchain.yml b/.github/workflows/update_functional_test_toolchain.yml
index 6816ee5..487dd36 100644
--- a/.github/workflows/update_functional_test_toolchain.yml
+++ b/.github/workflows/update_functional_test_toolchain.yml
@@ -29,7 +29,7 @@ jobs:
   update-toolchain:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Check for a newer Lean release
         id: check
@@ -73,7 +73,7 @@ jobs:
 
       - name: Create pull request
         if: steps.check.outputs.update == 'true'
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8
         with:
           token: ${{ secrets.TOOLCHAIN_UPDATE_TOKEN || github.token }}
           commit-message: "chore: update functional test toolchain to ${{ steps.check.outputs.latest }}"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 28e88ee..59feb45 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## Unreleased
 
+### Changed
+
+- pin the `actions/cache` steps, and all actions used by this repository's workflows, to full commit SHAs, so that `lean-action` works in organizations that require SHA-pinned actions
+
 ## v1.6.0 - 2026-08-22
 
 ### Added
diff --git a/action.yml b/action.yml
index 27638db..b0bc7ed 100644
--- a/action.yml
+++ b/action.yml
@@ -260,7 +260,7 @@ runs:
       shell: bash
       working-directory: ${{ inputs.lake-package-directory }}
 
-    - uses: actions/cache/restore@v5
+    - uses: actions/cache/restore@caa296126883cff596d87d8935842f9db880ef25 # v5
       if: ${{ inputs.use-github-cache == 'true' }}
       with:
         path: ${{ inputs.lake-package-directory }}/.lake
@@ -302,7 +302,7 @@ runs:
       shell: bash
       working-directory: ${{ inputs.lake-package-directory }}
 
-    - uses: actions/cache/save@v5
+    - uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5
       if: ${{ inputs.use-github-cache == 'true' }}
       with:
         path: ${{ inputs.lake-package-directory }}/.lake