diff --git a/.github/actions/build/action.yml b/.github/actions/build/action.yml
index cba02ac..d4e4356 100644
--- a/.github/actions/build/action.yml
+++ b/.github/actions/build/action.yml
@@ -13,7 +13,7 @@ runs:
   using: composite
   steps:
     - name: Set up Java ${{ inputs.java-version }}
-      uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
+      uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
       with:
         distribution: sapmachine
         java-version: ${{ inputs.java-version }}
diff --git a/.github/actions/prepare-next-version/action.yml b/.github/actions/prepare-next-version/action.yml
index db785b3..05d79d3 100644
--- a/.github/actions/prepare-next-version/action.yml
+++ b/.github/actions/prepare-next-version/action.yml
@@ -19,7 +19,7 @@ runs:
   using: composite
   steps:
     - name: Set up Java ${{ inputs.java-version }}
-      uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
+      uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
       with:
         java-version: ${{ inputs.java-version }}
         distribution: sapmachine
@@ -57,7 +57,7 @@ runs:
       shell: bash
 
     - name: Create Pull Request
-      uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7
+      uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.11
       with:
         commit-message: chore/release-${{ inputs.new-version }}
         title: "chore(version): version ${{ inputs.new-version }}"
diff --git a/.github/actions/release/action.yml b/.github/actions/release/action.yml
index be9b31d..3f57d8b 100644
--- a/.github/actions/release/action.yml
+++ b/.github/actions/release/action.yml
@@ -28,7 +28,7 @@ runs:
   using: composite
   steps:
     - name: Set up Java
-      uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
+      uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
       with:
         distribution: sapmachine
         java-version: ${{ inputs.java-version }}
diff --git a/.github/actions/scan-with-blackduck/action.yml b/.github/actions/scan-with-blackduck/action.yml
index 34afff5..88b0ef4 100644
--- a/.github/actions/scan-with-blackduck/action.yml
+++ b/.github/actions/scan-with-blackduck/action.yml
@@ -20,7 +20,7 @@ runs:
   using: composite
   steps:
     - name: Set up Java ${{ inputs.java-version }}
-      uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
+      uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
       with:
         java-version: ${{ inputs.java-version }}
         distribution: sapmachine
diff --git a/.github/actions/scan-with-sonar/action.yml b/.github/actions/scan-with-sonar/action.yml
index 5496401..f0120c9 100644
--- a/.github/actions/scan-with-sonar/action.yml
+++ b/.github/actions/scan-with-sonar/action.yml
@@ -20,7 +20,7 @@ runs:
 
   steps:
     - name: Set up Java ${{inputs.java-version}}
-      uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4
+      uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
       with:
         java-version: ${{inputs.java-version}}
         distribution: sapmachine
diff --git a/.github/workflows/blackduck.yml b/.github/workflows/blackduck.yml
index 0ad3643..72e86d2 100644
--- a/.github/workflows/blackduck.yml
+++ b/.github/workflows/blackduck.yml
@@ -24,7 +24,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       - name: Scan With Black Duck
         uses: ./.github/actions/scan-with-blackduck
         with:
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ca39939..d2a91b2 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -18,10 +18,10 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        java-version: [17, 21]
+        java-version: ["17.0.18", "21.0.9"]
     steps:
       - name: Checkout
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       - name: Build
         uses: ./.github/actions/build
         with:
@@ -29,7 +29,7 @@ jobs:
           maven-version: ${{ env.MAVEN_VERSION }}
       - name: Sonar Scan
         uses: ./.github/actions/scan-with-sonar
-        if: matrix.java-version == 21
+        if: matrix.java-version == '21.0.9'
         with:
           java-version: 21
           maven-version: ${{ env.MAVEN_VERSION }}
diff --git a/.github/workflows/prepare-next-version.yml b/.github/workflows/prepare-next-version.yml
index c3eb0e6..5b3eb45 100644
--- a/.github/workflows/prepare-next-version.yml
+++ b/.github/workflows/prepare-next-version.yml
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
         with:
           token: ${{ secrets.GH_TOKEN }}
       - name: Update version
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0174356..a843f49 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -16,14 +16,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
+        uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5.0.1
       - name: Build
         uses: ./.github/actions/build
         with:
           java-version: ${{ env.JAVA_VERSION }}
           maven-version: ${{ env.MAVEN_VERSION }}
       - name: Upload Changed Artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: root-build
           include-hidden-files: true
@@ -36,7 +36,7 @@ jobs:
     needs: [build]
     steps:
       - name: Download artifact
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5
+        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
         with:
           name: root-build
       - name: Deploy
diff --git a/.pipeline/config.yml b/.pipeline/config.yml
index 0fa4ce6..359f662 100644
--- a/.pipeline/config.yml
+++ b/.pipeline/config.yml
@@ -33,7 +33,7 @@ steps:
     dockerImage: ""
     options:
       - sonar.qualitygate.wait=true
-      - sonar.java.source=17
+      - sonar.java.source=21
       - sonar.sources=cds-feature-console/src/main/java
       - sonar.exclusions=**/node_modules/**,**/target/**
       - sonar.coverage.jacoco.xmlReportPaths=cds-feature-console/target/site/jacoco/jacoco.xml