diff --git a/.github/workflows/macos-cmake.yml b/.github/workflows/macos-cmake.yml
index d90bcaf69c..07ae8711d1 100644
--- a/.github/workflows/macos-cmake.yml
+++ b/.github/workflows/macos-cmake.yml
@@ -7,6 +7,9 @@ on:
         required: true
         description: "The ref we want to compile"
         type: string
+    secrets:
+      BUILD_CACHE_KEY:
+        required: true
 
 permissions:
   contents: read
@@ -25,18 +28,19 @@ jobs:
         os: [ macos-14, macos-15 ]
         shard: [ BqDriver ]
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       with:
         ref: ${{ inputs.checkout-ref }}
-    - uses: google-github-actions/auth@v2
+        persist-credentials: false
+    - uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed # v2.1.13
       with:
         create_credentials_file: true
         credentials_json: ${{ secrets.BUILD_CACHE_KEY }}
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       id: py311
       with:
         python-version: '3.11'
-    - uses: google-github-actions/setup-gcloud@v2
+    - uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f # v2.2.1
       with:
         version: '500.0.0'
       env:
@@ -59,34 +63,39 @@ jobs:
     - name: cmake version
       run: cmake --version
 
+
     - name: Install bison flex for 'arrow'
       run: brew install bison flex
     - name: Download and Install vcpkg
       working-directory: "${{runner.temp}}"
+      env:
+        VCPKG_VERSION: ${{ steps.dynamic.outputs.vcpkg-version }}
       run: |
-        git clone --branch ${{ steps.dynamic.outputs.vcpkg-version }} https://github.com/microsoft/vcpkg.git
+        git clone --branch "$VCPKG_VERSION" https://github.com/microsoft/vcpkg.git
         vcpkg/bootstrap-vcpkg.sh -disableMetrics
     - name: Install iODBC
       run: |
         brew install libiodbc
 
     - name: Setup the driver
+      env:
+        CLOUDSDK_PYTHON: ${{ steps.py311.outputs.python-path }}
       run: |
         export VCPKG_ROOT="${{ runner.temp }}/vcpkg"
         export PATH="$VCPKG_ROOT:/opt/homebrew/bin:$PATH"
         export LDFLAGS="-L$(brew --prefix libiodbc)/lib -liconv"
-        export PATH="$(dirname ${{ steps.py311.outputs.python-path }}):$PATH"
-        export CLOUDSDK_PYTHON="${{ steps.py311.outputs.python-path }}"
+        export PATH="$(dirname "$CLOUDSDK_PYTHON"):$PATH"
         bash ci/dependencies/driver-manager-setup-osx.sh
 
     - name: Build cpp-bigquery-odbc
+      env:
+        CLOUDSDK_PYTHON: ${{ steps.py311.outputs.python-path }}
       run: |
         export ODBC_PREFIX="$(brew --prefix libiodbc)"
         export ODBC_INCLUDE_PATH="$ODBC_PREFIX/include"
         export VCPKG_ROOT="${{ runner.temp }}/vcpkg"
 
-        export PATH="$(dirname ${{ steps.py311.outputs.python-path }}):$(brew --prefix)/bin:/opt/homebrew/bin:$VCPKG_ROOT:$PATH"
-        export CLOUDSDK_PYTHON="${{ steps.py311.outputs.python-path }}"
+        export PATH="$(dirname "$CLOUDSDK_PYTHON"):$(brew --prefix)/bin:/opt/homebrew/bin:$VCPKG_ROOT:$PATH"
         export LDFLAGS="-L$(brew --prefix libiodbc)/lib -liconv"
         bash ci/gha/builds/macos-cmake.sh
     env:
diff --git a/.github/workflows/macos-release.yml b/.github/workflows/macos-release.yml
index 1a191fa2f8..227d3b3ce9 100644
--- a/.github/workflows/macos-release.yml
+++ b/.github/workflows/macos-release.yml
@@ -24,21 +24,22 @@ jobs:
         os: [ macos-14]
         shard: [ BqDriver ]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           fetch-depth: 0
+          persist-credentials: false
 
-      - uses: google-github-actions/auth@v2
+      - uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed # v2.1.13
         with:
           create_credentials_file: true
           credentials_json: ${{ secrets.BUILD_CACHE_KEY }}
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         id: py311
         with:
           python-version: '3.11'
 
-      - uses: google-github-actions/setup-gcloud@v2
+      - uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f # v2.2.1
         with:
           version: '500.0.0'
         env:
@@ -65,30 +66,29 @@ jobs:
       - name: cmake version
         run: cmake --version
 
-
-
       - name: Install bison flex for 'arrow'
         run: brew install bison flex
 
       - name: Download and Install vcpkg
         working-directory: "${{runner.temp}}"
+        env:
+          VCPKG_VERSION: ${{ steps.dynamic.outputs.vcpkg-version }}
         run: |
-          git clone --branch ${{ steps.dynamic.outputs.vcpkg-version }} https://github.com/microsoft/vcpkg.git
+          git clone --branch "$VCPKG_VERSION" https://github.com/microsoft/vcpkg.git
           vcpkg/bootstrap-vcpkg.sh -disableMetrics
 
       - name: Install iODBC
         run: |
           brew install libiodbc
 
-
-
       - name: Setup and Build cpp-bigquery-odbc driver
+        env:
+          CLOUDSDK_PYTHON: ${{ steps.py311.outputs.python-path }}
         run: |
           export VCPKG_ROOT="${{ runner.temp }}/vcpkg"
           export PATH="$VCPKG_ROOT:/opt/homebrew/bin:$PATH"
           export LDFLAGS="-L$(brew --prefix libiodbc)/lib -liconv"
-          export PATH="$(dirname ${{ steps.py311.outputs.python-path }}):$PATH"
-          export CLOUDSDK_PYTHON="${{ steps.py311.outputs.python-path }}"
+          export PATH="$(dirname "$CLOUDSDK_PYTHON"):$PATH"
           bash ci/gha/builds/macos-release-setup.sh
           export ODBC_INCLUDE_PATH="/opt/homebrew/opt/libiodbc/include"
           bash ci/gha/builds/macos-cmake.sh
@@ -112,6 +112,8 @@ jobs:
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
       - name: Create TAR Package
+        env:
+          DRIVER_VERSION: ${{ steps.version.outputs.version }}
         run: |
           set -euo pipefail
 
@@ -139,20 +141,22 @@ jobs:
           cp -rv ci/etc/roots.pem release_package/lib/roots.pem
 
           # Create TAR.GZ file
-          TAR_NAME="ODBCDriverforBigQuery_macos_${{ steps.version.outputs.version }}.tar.gz"
+          TAR_NAME="ODBCDriverforBigQuery_macos_${DRIVER_VERSION}.tar.gz"
           tar -czvf "$TAR_NAME" -C release_package .
 
           echo "TAR package created: $TAR_NAME"
 
       - name: Attest build provenance
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
         with:
           subject-path: ODBCDriverforBigQuery_macos_${{ steps.version.outputs.version }}.tar.gz
 
       - name: Upload TAR to GitHub Release
-        uses: softprops/action-gh-release@v2
-        with:
-          files: ODBCDriverforBigQuery_macos_${{ steps.version.outputs.version }}.tar.gz
+        env:
+          DRIVER_VERSION: ${{ steps.version.outputs.version }}
+          BRANCH_NAME: ${{ github.ref_name }}
+        run: |
+          gh release upload "$BRANCH_NAME" "ODBCDriverforBigQuery_macos_${DRIVER_VERSION}.tar.gz" --clobber
 
     env:  
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/test-runner.yml b/.github/workflows/test-runner.yml
index 0574ce1848..1c42915c2f 100644
--- a/.github/workflows/test-runner.yml
+++ b/.github/workflows/test-runner.yml
@@ -38,6 +38,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}-${{ github.event_name == 'workflow_dispatch' && github.run_id || '' }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   pre-flight:
     # Manual runs (workflow_dispatch) are treated as internal/trusted
@@ -75,7 +78,8 @@ jobs:
     uses: ./.github/workflows/macos-cmake.yml
     with:
       checkout-ref: ${{ needs.pre-flight.outputs.checkout-sha }}
-    secrets: inherit
+    secrets:
+      BUILD_CACHE_KEY: ${{ secrets.BUILD_CACHE_KEY }}
   windows-cmake:
     name: Windows-CMake
     if: |
@@ -84,7 +88,8 @@ jobs:
     uses: ./.github/workflows/windows-cmake.yml
     with:
       checkout-ref: ${{ needs.pre-flight.outputs.checkout-sha }}
-    secrets: inherit
+    secrets:
+      BUILD_CACHE_KEY: ${{ secrets.BUILD_CACHE_KEY }}
 
   windows-benchmark-bq:
     name: Windows-Benchmark (Google Driver)
@@ -98,7 +103,8 @@ jobs:
     with:
       checkout-ref: ${{ needs.pre-flight.outputs.checkout-sha }}
       build_shard: 'BqDriver'
-    secrets: inherit
+    secrets:
+      BUILD_CACHE_KEY: ${{ secrets.BUILD_CACHE_KEY }}
 
   windows-benchmark-existing:
     name: Windows-Benchmark (Existing Driver)
@@ -112,7 +118,8 @@ jobs:
     with:
       checkout-ref: ${{ needs.pre-flight.outputs.checkout-sha }}
       build_shard: 'Core'
-    secrets: inherit
+    secrets:
+      BUILD_CACHE_KEY: ${{ secrets.BUILD_CACHE_KEY }}
 
   windows-benchmark-results:
     name: Windows-Benchmark (Generate Results Table)
@@ -125,24 +132,27 @@ jobs:
     permissions:
       contents: read
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: ${{ needs.pre-flight.outputs.checkout-sha }}
+          persist-credentials: false
 
-      - uses: google-github-actions/auth@v2
+      - uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed # v2.1.13
         with:
           create_credentials_file: true
           credentials_json: ${{ secrets.BUILD_CACHE_KEY }}
 
-      - uses: google-github-actions/setup-gcloud@v2
+      - uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f # v2.2.1
 
       - name: Download Results from GCS
+        env:
+          BRANCH_NAME: ${{ github.ref_name }}
         run: |
           mkdir -p benchmark_results
 
-          gcloud storage cp gs://bq-dev-tools-testing-drivers/odbc-perf/${{ github.ref_name }}/results/performance_benchmark_results_BqDriver.txt ./benchmark_results/current_bq.txt || true
+          gcloud storage cp gs://bq-dev-tools-testing-drivers/odbc-perf/$BRANCH_NAME/results/performance_benchmark_results_BqDriver.txt ./benchmark_results/current_bq.txt || true
 
-          gcloud storage cp gs://bq-dev-tools-testing-drivers/odbc-perf/${{ github.ref_name }}/results/performance_benchmark_results_Core.txt ./benchmark_results/current_core.txt || true
+          gcloud storage cp gs://bq-dev-tools-testing-drivers/odbc-perf/$BRANCH_NAME/results/performance_benchmark_results_Core.txt ./benchmark_results/current_core.txt || true
 
           gcloud storage cp gs://bq-dev-tools-testing-drivers/odbc-perf/main/results/performance_benchmark_results_BqDriver.txt ./benchmark_results/main_bq.txt || true
 
@@ -258,6 +268,8 @@ jobs:
           EOF
 
       - name: Upload Table to GCS
+        env:
+          BRANCH_NAME: ${{ github.ref_name }}
         run: |
-          gcloud storage cp benchmark_summary_table.txt gs://bq-dev-tools-testing-drivers/odbc-perf/${{ github.ref_name }}/results/
-          echo "Uploaded benchmark table to gs://bq-dev-tools-testing-drivers/odbc-perf/${{ github.ref_name }}/results/benchmark_summary_table.txt"
+          gcloud storage cp benchmark_summary_table.txt gs://bq-dev-tools-testing-drivers/odbc-perf/$BRANCH_NAME/results/
+          echo "Uploaded benchmark table to gs://bq-dev-tools-testing-drivers/odbc-perf/$BRANCH_NAME/results/benchmark_summary_table.txt"
diff --git a/.github/workflows/windows-benchmark.yml b/.github/workflows/windows-benchmark.yml
index c488af8971..2a26e0b5e2 100644
--- a/.github/workflows/windows-benchmark.yml
+++ b/.github/workflows/windows-benchmark.yml
@@ -12,6 +12,9 @@ on:
         description: "The driver shard to test (Core or BqDriver)"
         type: string
         default: "BqDriver"
+    secrets:
+      BUILD_CACHE_KEY:
+        required: true
   workflow_dispatch:
     inputs:
       build_shard:
@@ -34,26 +37,27 @@ jobs:
       DRIVER_ARCH: x64
       BUILD_SHARD: ${{ inputs.build_shard }}
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         ref: ${{ inputs.checkout-ref || github.ref }}
+        persist-credentials: false
 
-    - uses: google-github-actions/auth@v2
+    - uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed # v2.1.13
       with:
         create_credentials_file: true
         credentials_json: ${{ secrets.BUILD_CACHE_KEY }}
 
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       id: py311
       with:
         python-version: '3.11'
 
-    - uses: google-github-actions/setup-gcloud@v2
+    - uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f # v2.2.1
       env:
         CLOUDSDK_PYTHON: ${{ steps.py311.outputs.python-path }}
 
     - name: Install CMake
-      uses: lukka/get-cmake@latest
+      uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
       with:
         cmakeVersion: "3.29.0"
 
@@ -61,10 +65,12 @@ jobs:
     - name: Download Installer from GCS
       if: env.BUILD_SHARD == 'BqDriver'
       shell: bash
+      env:
+        BRANCH_NAME: ${{ github.ref_name }}
       run: |
         mkdir -p installer_dl
         # Sanitize the branch name replacing any character not in [a-zA-Z0-9-] with '_'
-        SANITIZED_BRANCH=$(echo "${{ github.ref_name }}" | sed -E 's/[^a-zA-Z0-9-]/_/g')
+        SANITIZED_BRANCH=$(echo "$BRANCH_NAME" | sed -E 's/[^a-zA-Z0-9-]/_/g')
         gcloud storage cp gs://odbc-integration-builds/${SANITIZED_BRANCH}/*.msi ./installer_dl/
 
     - name: Install the ODBC Driver
@@ -119,6 +125,8 @@ jobs:
 
     - name: Run Benchmarks & Save Output
       shell: bash
+      env:
+        BRANCH_NAME: ${{ github.ref_name }}
       run: |
         export RESULTS_FILE="performance_benchmark_results_${BUILD_SHARD}.txt"
         export GOOGLE_APPLICATION_CREDENTIALS="C:\\b\\service_account_auth_keys.json"
@@ -141,7 +149,7 @@ jobs:
         set -e
 
         echo "Uploading results to GCS..."
-        gcloud storage cp "$RESULTS_FILE" gs://bq-dev-tools-testing-drivers/odbc-perf/${{ github.ref_name }}/results/
+        gcloud storage cp "$RESULTS_FILE" gs://bq-dev-tools-testing-drivers/odbc-perf/$BRANCH_NAME/results/
 
         if [ $TEST_EXIT_CODE -ne 0 ]; then
           echo "ERROR: Benchmark executable failed with exit code $TEST_EXIT_CODE."
diff --git a/.github/workflows/windows-cmake.yml b/.github/workflows/windows-cmake.yml
index 19d28bc79a..a52a6b7afa 100644
--- a/.github/workflows/windows-cmake.yml
+++ b/.github/workflows/windows-cmake.yml
@@ -7,6 +7,9 @@ on:
         required: true
         description: "The ref we want to compile"
         type: string
+    secrets:
+      BUILD_CACHE_KEY:
+        required: true
 
 permissions:
   contents: read
@@ -32,23 +35,24 @@ jobs:
       ODBC_GOOGLE_DRIVER_VERSION: 99.99.99
       VCPKG_TRIPLET: ${{ matrix.arch }}-windows
     steps:
-    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         ref: ${{ inputs.checkout-ref }}
-    - uses: google-github-actions/auth@v2
+        persist-credentials: false
+    - uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed # v2.1.13
       with:
         create_credentials_file: true
         credentials_json: ${{ secrets.BUILD_CACHE_KEY }}
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       id: py311
       with:
         python-version: '3.11'
-    - uses: google-github-actions/setup-gcloud@v2
+    - uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f # v2.2.1
       env:
         CLOUDSDK_PYTHON: ${{ steps.py311.outputs.python-path }}
     # We are deliberately downgrading cmake here because v3.31.0 runs each integration test twice
     - name: Install CMake
-      uses: lukka/get-cmake@latest
+      uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
       with:
         cmakeVersion: "3.29.0"
     - name: Dynamic Configuration
@@ -58,6 +62,7 @@ jobs:
         echo "vcpkg-version=$(cat ci/etc/vcpkg-version.txt)" >> "${GITHUB_OUTPUT}"
         echo "VCPKG_BINARY_SOURCES=clear;files,${{ runner.temp }}/vcpkg-cache,readwrite" >> "${GITHUB_ENV}"
 
+
     - name: Ensure .NET Framework 4.5 or higher is installed
       shell: powershell
       run: |
@@ -78,14 +83,16 @@ jobs:
 
     - name: Download and Install vcpkg
       shell: bash
+      env:
+        VCPKG_VERSION: ${{ steps.dynamic.outputs.vcpkg-version }}
       run: |
         cd "${TEMP}"
         mkdir .build
         cd .build
-        git clone --branch ${{ steps.dynamic.outputs.vcpkg-version }} https://github.com/microsoft/vcpkg.git
+        git clone --branch "$VCPKG_VERSION" https://github.com/microsoft/vcpkg.git
         ./vcpkg/bootstrap-vcpkg.sh -disableMetrics
     - name: Restore vcpkg binaries cache
-      uses: actions/cache/restore@v4
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       id: cache-restore
       with:
         path: ${{ runner.temp }}/vcpkg-cache
@@ -98,21 +105,21 @@ jobs:
     #   https://github.com/microsoft/vswhere/wiki/Find-VC
     # Note that in other runners the publisher is GitHub. If we trust GitHub
     # to run the VM, we should trust their runners.
-    - uses: ilammy/msvc-dev-cmd@cec98b9d092141f74527d0afa6feb2af698cfe89 # @v1.21.1
+    - uses: ilammy/msvc-dev-cmd@cec98b9d092141f74527d0afa6feb2af698cfe89 # v1.12.1
       with:
         arch: ${{ matrix.arch }}
 
     - name: Build cpp-bigquery-odbc
       shell: bash
+      env:
+        CLOUDSDK_PYTHON: ${{ steps.py311.outputs.python-path }}
+        BRANCH_NAME: ${{ github.ref_name }}
       run: |
         export VCPKG_ROOT="${TEMP}/.build/vcpkg"
-        export CLOUDSDK_PYTHON="${{ steps.py311.outputs.python-path }}"
         export CMAKE_OUT="c:/b"
 
-
-
         export MSVC_VERSION="${{ matrix.msvc }}"
-        export BRANCH_IDENTIFIER=$(echo "${{ github.ref_name }}" | tr '[:punct:]' '_')
+        export BRANCH_IDENTIFIER=$(echo "$BRANCH_NAME" | tr '[:punct:]' '_')
 
         # We don't want to install 'arrow' in x86 because it is not supported
         if [ "${{ matrix.arch }}" == "x86" ]; then
@@ -122,7 +129,7 @@ jobs:
         ci/gha/builds/windows-cmake-integration.sh
 
     - name: Save vcpkg binaries cache
-      uses: actions/cache/save@v4
+      uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       if: always() && steps.cache-restore.outputs.cache-hit != 'true'
       with:
         path: ${{ runner.temp }}/vcpkg-cache
@@ -160,15 +167,17 @@ jobs:
         Write-Output "DSN creation completed."
     - name: Running testcases
       shell: bash
+      env:
+        CLOUDSDK_PYTHON: ${{ steps.py311.outputs.python-path }}
+        BRANCH_NAME: ${{ github.ref_name }}
       run: |
         export VCPKG_ROOT="${TEMP}/.build/vcpkg"
-        export CLOUDSDK_PYTHON="${{ steps.py311.outputs.python-path }}"
         # Put the CMake output in a directory with more space and keep it short
         # to avoid running into the MSVC limits.
         export CMAKE_OUT='c:\b'
         export MSVC_VERSION="${{ matrix.msvc }}"
-        export BRANCH_IDENTIFIER=$(echo "${{ github.ref_name }}" | tr '[:punct:]' '_')
-        export CPP_BIGQUERY_ODBC_TEST_TABLE_PREFIX="windows_${BRANCH_IDENTIFIER}_${MSVC_VERSION//[-:;.,?\/]/_}_${{ matrix.arch}}_$BUILD_SHARD"
+        export BRANCH_IDENTIFIER=$(echo "$BRANCH_NAME" | tr '[:punct:]' '_')
+        export CPP_BIGQUERY_ODBC_TEST_TABLE_PREFIX="windows_${BRANCH_IDENTIFIER}_${MSVC_VERSION//[-:;.,?\/]/_}_${DRIVER_ARCH}_$BUILD_SHARD"
 
         export GOOGLE_APPLICATION_CREDENTIALS="$GOOGLE_GHA_CREDS_PATH"
         export CLOUDSDK_AUTH_CREDENTIAL_FILE_OVERRIDE="$GOOGLE_GHA_CREDS_PATH"
diff --git a/.github/workflows/windows-release.yml b/.github/workflows/windows-release.yml
index d2830aec99..dede6bfee2 100644
--- a/.github/workflows/windows-release.yml
+++ b/.github/workflows/windows-release.yml
@@ -27,23 +27,24 @@ jobs:
       BUILD_SHARD: ${{ matrix.shard }}
       VCPKG_TRIPLET: ${{ matrix.arch }}-windows
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       with:
         ref: ${{ inputs.checkout-ref }}
-    - uses: google-github-actions/auth@v2
+        persist-credentials: false
+    - uses: google-github-actions/auth@c200f3691d83b41bf9bbd8638997a462592937ed # v2.1.13
       with:
         create_credentials_file: true
         credentials_json: ${{ secrets.BUILD_CACHE_KEY }}
-    - uses: actions/setup-python@v5
+    - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
       id: py311
       with:
         python-version: '3.11'
-    - uses: google-github-actions/setup-gcloud@v2
+    - uses: google-github-actions/setup-gcloud@e427ad8a34f8676edf47cf7d7925499adf3eb74f # v2.2.1
       env:
         CLOUDSDK_PYTHON: ${{ steps.py311.outputs.python-path }}
     # We are deliberately downgrading cmake here because v3.31.0 runs each integration test twice
     - name: Install CMake
-      uses: lukka/get-cmake@latest
+      uses: lukka/get-cmake@e6906078ebd1ccb8ce51ab4626ac46a1b5a517e3 # v4.4.0
       with:
         cmakeVersion: "3.29.0"
     - name: Dynamic Configuration
@@ -53,6 +54,7 @@ jobs:
         echo "vcpkg-version=$(cat ci/etc/vcpkg-version.txt)" >> "${GITHUB_OUTPUT}"
         echo "VCPKG_BINARY_SOURCES=clear;files,${{ runner.temp }}/vcpkg-cache,readwrite" >> "${GITHUB_ENV}"
 
+
     - name: Ensure .NET Framework 4.5 or higher is installed
       shell: powershell
       run: |
@@ -73,14 +75,16 @@ jobs:
 
     - name: Download and Install vcpkg
       shell: bash
+      env:
+        VCPKG_VERSION: ${{ steps.dynamic.outputs.vcpkg-version }}
       run: |
         cd "${TEMP}"
         mkdir .build
         cd .build
-        git clone --branch ${{ steps.dynamic.outputs.vcpkg-version }} https://github.com/microsoft/vcpkg.git
+        git clone --branch "$VCPKG_VERSION" https://github.com/microsoft/vcpkg.git
         ./vcpkg/bootstrap-vcpkg.sh -disableMetrics
-    - name: Cache vcpkg binaries
-      uses: actions/cache@v4
+    - name: Restore cached vcpkg binaries
+      uses: actions/cache/restore@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
       with:
         path: ${{ runner.temp }}/vcpkg-cache
         key: vcpkg-cache-${{ matrix.msvc }}-${{ matrix.arch }}-${{ hashFiles('vcpkg.json', 'ci/etc/vcpkg-version.txt') }}
@@ -92,7 +96,7 @@ jobs:
     #   https://github.com/microsoft/vswhere/wiki/Find-VC
     # Note that in other runners the publisher is GitHub. If we trust GitHub
     # to run the VM, we should trust their runners.
-    - uses: ilammy/msvc-dev-cmd@cec98b9d092141f74527d0afa6feb2af698cfe89 # @v1.21.1
+    - uses: ilammy/msvc-dev-cmd@cec98b9d092141f74527d0afa6feb2af698cfe89 # v1.12.1
       with:
         arch: ${{ matrix.arch }}
     - name: Read driver version from github tag
@@ -105,14 +109,18 @@ jobs:
         echo "version=$VERSION" >> "$GITHUB_OUTPUT"
     - name: Build cpp-bigquery-odbc
       shell: bash
+      env:
+        CLOUDSDK_PYTHON: ${{ steps.py311.outputs.python-path }}
+        DRIVER_VERSION: ${{ steps.version.outputs.version }}
+        BRANCH_NAME: ${{ github.ref_name }}
       run: |
         export VCPKG_ROOT="${TEMP}/.build/vcpkg"
-        export CLOUDSDK_PYTHON="${{ steps.py311.outputs.python-path }}"
         export CMAKE_OUT="c:/b"
 
 
+
         export MSVC_VERSION="${{ matrix.msvc }}"
-        export BRANCH_IDENTIFIER=$(echo "${{ github.ref_name }}" | tr '[:punct:]' '_')
+        export BRANCH_IDENTIFIER=$(echo "$BRANCH_NAME" | tr '[:punct:]' '_')
         export CPP_BIGQUERY_ODBC_TEST_TABLE_PREFIX="windows_${BRANCH_IDENTIFIER}_${MSVC_VERSION//[-:;.,?\/]/_}_${DRIVER_ARCH}_$BUILD_SHARD"
 
         # choose correct triplet for architecture
@@ -124,7 +132,7 @@ jobs:
         fi
 
         echo "Using VCPKG_TRIPLET=${VCPKG_TRIPLET}"
-        version=${{ steps.version.outputs.version }}
+        version=$DRIVER_VERSION
         echo "Building version: $version"
         cmake -S . -B build \
           -G Ninja \
@@ -173,8 +181,10 @@ jobs:
 
     - name: Run Upgrade Code for driver version
       shell: pwsh
+      env:
+        DRIVER_VERSION: ${{ steps.version.outputs.version }}
       run: |
-        $version = "${{ steps.version.outputs.version }}"
+        $version = "$env:DRIVER_VERSION"
         $wix_version = "$version"
 
         Write-Output "Using version: $wix_version"
@@ -198,33 +208,30 @@ jobs:
         ./ci/installer/ODBCDriverForBigQuery/upgrade_code.ps1 -new_version "$wix_version"
 
     - name: Build Windows Installer (WiX)
-      shell: cmd
       run: |
-        echo Locating MSBuild...
-        for /f "usebackq delims=" %%i in (`"C:\Program Files (x86)\Microsoft Visual Studio\Installer\vswhere.exe" -latest -products * -requires Microsoft.Component.MSBuild -find MSBuild\**\Bin\MSBuild.exe`) do (
-            set MSBUILD_PATH=%%i
-        )
-        echo MSBuild found at: %MSBUILD_PATH%
+        Write-Output "Locating MSBuild..."
+        $msbuildPath = & "C:\Program Files (x86)\Microsoft Visual Studio\Installer\vswhere.exe" -latest -products * -requires Microsoft.Component.MSBuild -find MSBuild\**\Bin\MSBuild.exe | Select-Object -First 1
+        Write-Output "MSBuild found at: $msbuildPath"
 
-        echo Changing directory to WiX project folder...
-        cd ci\installer\ODBCDriverForBigQuery
-        dir
-
-        echo Building installer with MSBuild...
-        "%MSBUILD_PATH%" ODBCDriverForBigQuery.wixproj /p:Configuration=Release /p:Platform=%DRIVER_ARCH%
+        Write-Output "Building installer with MSBuild..."
+        & $msbuildPath ci\installer\ODBCDriverForBigQuery\ODBCDriverForBigQuery.wixproj /p:Configuration=Release /p:Platform=$env:DRIVER_ARCH
 
     - name: Rename MSI
       shell: bash
+      env:
+        DRIVER_VERSION: ${{ steps.version.outputs.version }}
       run: |
         MSI_DIR="ci/installer/ODBCDriverForBigQuery/bin/Release/en-us"
         for f in "$MSI_DIR"/*.msi; do
-          mv "$f" "$MSI_DIR/ODBCDriverforBigQuery_windows_${DRIVER_ARCH}_${{ steps.version.outputs.version }}.msi"
+          mv "$f" "$MSI_DIR/ODBCDriverforBigQuery_windows_${DRIVER_ARCH}_${DRIVER_VERSION}.msi"
         done
 
     - name: Download and Install the ODBC Driver
       shell: powershell
+      env:
+        DRIVER_VERSION: ${{ steps.version.outputs.version }}
       run: |
-        $msiPath = "ci/installer/ODBCDriverForBigQuery/bin/Release/en-us/ODBCDriverforBigQuery_windows_${{ matrix.arch }}_${{ steps.version.outputs.version }}.msi"
+        $msiPath = "ci/installer/ODBCDriverForBigQuery/bin/Release/en-us/ODBCDriverforBigQuery_windows_$($env:DRIVER_ARCH)_$($env:DRIVER_VERSION).msi"
         .\ci\gha\builds\lib\odbc-driver-install.ps1 -LocalMsiPath $msiPath
 
     - name: Run DSN Creation Script
@@ -249,11 +256,13 @@ jobs:
 
     - name: Running testcases
       shell: bash
+      env:
+        CLOUDSDK_PYTHON: ${{ steps.py311.outputs.python-path }}
+        BRANCH_NAME: ${{ github.ref_name }}
       run: |
         export VCPKG_ROOT="${TEMP}/.build/vcpkg"
-        export CLOUDSDK_PYTHON="${{ steps.py311.outputs.python-path }}"
         export MSVC_VERSION="${{ matrix.msvc }}"
-        export BRANCH_IDENTIFIER=$(echo "${{ github.ref_name }}" | tr '[:punct:]' '_')
+        export BRANCH_IDENTIFIER=$(echo "$BRANCH_NAME" | tr '[:punct:]' '_')
         export CPP_BIGQUERY_ODBC_TEST_TABLE_PREFIX="windows_${BRANCH_IDENTIFIER}_${MSVC_VERSION//[-:;.,?\/]/_}_${DRIVER_ARCH}_$BUILD_SHARD"
         export CPP_BIGQUERY_ODBC_TEST_SERVICE_ACCOUNT_AUTH_KEY="C:\\b\\service_account_auth_keys.json"
         export GOOGLE_APPLICATION_CREDENTIALS="C:\\b\\service_account_auth_keys.json"
@@ -268,28 +277,30 @@ jobs:
         ctest --output-on-failure --parallel 16
 
     - name: Attest build provenance
-      uses: actions/attest-build-provenance@v2
+      uses: actions/attest-build-provenance@e8998f949152b193b063cb0ec769d69d929409be # v2.4.0
       with:
         subject-path: ci/installer/ODBCDriverForBigQuery/bin/Release/en-us/ODBCDriverforBigQuery_windows_${{ matrix.arch }}_${{ steps.version.outputs.version }}.msi
 
     - name: Release Driver
-      uses: softprops/action-gh-release@v2
-      with:
-        files: ci/installer/ODBCDriverForBigQuery/bin/Release/en-us/*_${{ env.DRIVER_ARCH }}_${{ steps.version.outputs.version }}.msi
-        overwrite_files: true
-        name: "ODBC Driver for BigQuery (${{ env.DRIVER_ARCH }})"
-        body: "Windows release build for architecture: **${{ env.DRIVER_ARCH }}**"
+      shell: bash
+      env:
+        DRIVER_VERSION: ${{ steps.version.outputs.version }}
+        BRANCH_NAME: ${{ github.ref_name }}
+      run: |
+        gh release create "$BRANCH_NAME" --title "ODBC Driver for BigQuery" --notes "Release build for $BRANCH_NAME" || true
+        gh release upload "$BRANCH_NAME" ci/installer/ODBCDriverForBigQuery/bin/Release/en-us/*_${DRIVER_ARCH}_${DRIVER_VERSION}.msi --clobber
 
     - name: Upload MSI to GCS
       shell: pwsh
       env:
         GCS_BUCKET: bq-dev-tools-testing-drivers
+        DRIVER_VERSION: ${{ steps.version.outputs.version }}
       run: |
         # Map x64->64 and x86->32
         $arch = if ($env:DRIVER_ARCH -eq 'x64') { '64' } else { '32' }
 
         $MSI_DIR = "ci/installer/ODBCDriverForBigQuery/bin/Release/en-us"
-        $MSI_FILE = "ODBCDriverforBigQuery_windows_$($env:DRIVER_ARCH)_${{ steps.version.outputs.version }}.msi"
+        $MSI_FILE = "ODBCDriverforBigQuery_windows_$($env:DRIVER_ARCH)_$($env:DRIVER_VERSION).msi"
 
         Write-Output "Uploading $MSI_FILE to gs://$env:GCS_BUCKET/odbc-windows/$arch/ ..."
         gsutil -m cp `