diff --git a/.github/workflows/updatecli.yaml b/.github/workflows/updatecli.yaml
index 59398d5f..3867b969 100644
--- a/.github/workflows/updatecli.yaml
+++ b/.github/workflows/updatecli.yaml
@@ -1,3 +1,4 @@
+---
 name: Updatecli
 on:
   release:
@@ -5,19 +6,16 @@ on:
   schedule:
     # Run at 12:00 every Saterday every 14 days
     - cron: "0 12 */14 * *"
-
 jobs:
   updatecli:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout"
         uses: "actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3" # v6.0.0
-
       - name: "Setup updatecli"
-        uses: "updatecli/updatecli-action@v3.0.0"
+        uses: "updatecli/updatecli-action@2cc8e6d8e356d76b0280cdd03766c36596a0614e" # v3.0.0
         with:
           version: "v0.115.0"
-
       - name: "Run updatecli"
         run: updatecli compose apply --clean-git-branches=true --experimental
         env:
diff --git a/.github/workflows/updatecli_release.yaml b/.github/workflows/updatecli_release.yaml
index 3e5b6419..ae5836ac 100644
--- a/.github/workflows/updatecli_release.yaml
+++ b/.github/workflows/updatecli_release.yaml
@@ -15,17 +15,14 @@ jobs:
     steps:
       - name: "Checkout"
         uses: "actions/checkout@v4"
-
       - name: "Install Updatecli"
-        uses: "updatecli/updatecli-action@v3.0.0"
+        uses: "updatecli/updatecli-action@2cc8e6d8e356d76b0280cdd03766c36596a0614e" # v3.0.0
         with:
           version: "v0.115.0"
-
       # releasepost is required by the Updatecli
       #   * policy ghcr.io/updatecli/policies/releasepost/releasepost
       - name: "Install Releasepost"
         uses: "updatecli/releasepost-action@v0.5.0"
-
       - name: "Run updatecli only on release pipelines"
         run: updatecli compose apply --clean-git-branches=true --labels="release:updatecli" --experimental
         env:
@@ -35,7 +32,6 @@ jobs:
           UPDATECLI_UDASH_API_URL: ${{ secrets.UPDATECLI_UDASH_API_URL }}
           UPDATECLI_UDASH_ACCESS_TOKEN: ${{ secrets.UPDATECLI_UDASH_ACCESS_TOKEN }}
           UPDATECLI_UDASH_URL: ${{ secrets.UPDATECLI_UDASH_URL }}
-
       - name: "Run updatecli"
         run: "updatecli compose apply --file updatecli-compose-release.yaml --experimental"
         env:
diff --git a/.github/workflows/updatecli_test.yaml b/.github/workflows/updatecli_test.yaml
index 92cdfa42..7932cdb9 100644
--- a/.github/workflows/updatecli_test.yaml
+++ b/.github/workflows/updatecli_test.yaml
@@ -1,23 +1,18 @@
 name: Updatecli Test
-
 on:
   pull_request:
-
 permissions:
   contents: read
-
 jobs:
   updatecli:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout"
         uses: "actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3" # v6.0.0
-
       - name: "Setup updatecli"
-        uses: "updatecli/updatecli-action@v3.0.0"
+        uses: "updatecli/updatecli-action@2cc8e6d8e356d76b0280cdd03766c36596a0614e" # v3.0.0
         with:
           version: "v0.115.0"
-
       - name: "Test updatecli in dry-run mode"
         run: "updatecli compose diff --experimental"
         env:
diff --git a/.github/workflows/updatecli_update.yaml b/.github/workflows/updatecli_update.yaml
index db1c48b3..37346be6 100644
--- a/.github/workflows/updatecli_update.yaml
+++ b/.github/workflows/updatecli_update.yaml
@@ -1,22 +1,20 @@
+---
 name: Updatecli - Update
 on:
   workflow_dispatch:
   push:
     branches:
       - main
-
 jobs:
   updatecli:
     runs-on: ubuntu-latest
     steps:
       - name: "Checkout"
         uses: "actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3" # v6.0.0
-
       - name: "Setup updatecli"
-        uses: "updatecli/updatecli-action@v3.0.0"
+        uses: "updatecli/updatecli-action@2cc8e6d8e356d76b0280cdd03766c36596a0614e" # v3.0.0
         with:
           version: "v0.115.0"
-
       - name: "Run updatecli only on monitored pipelines"
         run: updatecli compose apply --clean-git-branches=true --labels="monitor:active" --experimental
         env:
@@ -26,7 +24,6 @@ jobs:
           UPDATECLI_UDASH_API_URL: ${{ secrets.UPDATECLI_UDASH_API_URL }}
           UPDATECLI_UDASH_ACCESS_TOKEN: ${{ secrets.UPDATECLI_UDASH_ACCESS_TOKEN }}
           UPDATECLI_UDASH_URL: ${{ secrets.UPDATECLI_UDASH_URL }}
-
       - name: "Run updatecli only on existing pipelines"
         run: updatecli compose apply --clean-git-branches=true --existing-only=true --experimental
         env: