diff --git a/.gitea/workflows/cd.yaml b/.gitea/workflows/cd.yaml
index a6baa06..f2b5ace 100644
--- a/.gitea/workflows/cd.yaml
+++ b/.gitea/workflows/cd.yaml
@@ -10,7 +10,7 @@ jobs:
     name: Release
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
       - name: Increment tag
diff --git a/.gitea/workflows/ci.yaml b/.gitea/workflows/ci.yaml
index f1d781c..3d34c12 100644
--- a/.gitea/workflows/ci.yaml
+++ b/.gitea/workflows/ci.yaml
@@ -7,13 +7,13 @@ jobs:
   test-setup-trivy:
     strategy:
       matrix:
-        arch: [amd64, arm64]
+        arch: [ amd64, arm64 ]
     name: Test Setup Trivy ${{ matrix.arch }}
     runs-on:
       - ubuntu-latest
       - linux_${{ matrix.arch }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Setup Trivy
         uses: ./setup-trivy
       - name: Run Trivy
@@ -24,7 +24,7 @@ jobs:
     runs-on:
       - ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - uses: ./setup-trivy
       - name: Setup DB
         id: setup-db
@@ -37,7 +37,7 @@ jobs:
     runs-on:
       - ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - id: giff
         uses: ./get-images-from-files
         with:
@@ -53,24 +53,24 @@ jobs:
           echo "$images" | jq .
           echo ""
           check() { echo -n "  $1: "; echo "$images" | jq -e --arg ref "$2" 'index($ref) != null' >/dev/null && echo "OK" || { echo "FAIL (not found)"; exit 1; }; }
-          
+
           # Dockerfile-only refs
           check "Dockerfile registry+tag (nginx:v1)" "example.com/library/nginx:v1"
           check "Dockerfile registry+digest (base@sha256:...)" "example.com/library/base@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
-          
+
           # K8s-only refs
           check "K8s registry+tag (app:v2)" "example.com/library/app:v2"
           check "K8s registry+digest (helper@sha256:...)" "example.com/myproject/helper@sha256:bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
-          
+
           # Compose-only refs
           check "Compose registry+tag (web:v3)" "example.com/compose/web:v3"
           check "Compose registry+tag (worker:v3)" "example.com/compose/worker:v3"
-          
+
           # Helmfile values (repository + tag, optional registry)
           check "Helmfile image (repository+tag)" "example.com/helmfile/app:v4"
           check "Helmfile images.worker (repository+tag)" "example.com/helmfile/worker:v5"
           check "Helmfile images.helper (repository+tag with digest)" "example.com/myproject/helper:2.0@sha256:cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc"
-          
+
           # Shared ref (in both files) — must appear exactly once
           check "Shared ref present (distroless/static:nonroot)" "example.com/distroless/static:nonroot"
           count=$(echo "$images" | jq '[.[] | select(. == "example.com/distroless/static:nonroot")] | length')
@@ -79,6 +79,6 @@ jobs:
           total=$(echo "$images" | jq 'length')
           echo -n "  Total unique refs: "
           [ "$total" -eq 10 ] && echo "OK ($total)" || { echo "FAIL (got $total, expected 10)"; exit 1; }
-          
+
           echo ""
           echo "All checks passed."
diff --git a/.gitea/workflows/prerelease.yaml b/.gitea/workflows/prerelease.yaml
index fac7cfc..05118d1 100644
--- a/.gitea/workflows/prerelease.yaml
+++ b/.gitea/workflows/prerelease.yaml
@@ -8,7 +8,7 @@ jobs:
     name: Prerelease
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
       - name: Increment tag