diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ed70ddb..7d88e08 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -16,13 +16,13 @@ jobs:
 
     steps:
       - name: Check out repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
       - name: Set up pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
 
       - name: Set up node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
         with:
           node-version: 20
           cache: 'pnpm'
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index d0ef40f..e587d63 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -16,13 +16,13 @@ jobs:
 
     steps:
       - name: Check out repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
       - name: Set up pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
 
       - name: Set up node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
         with:
           node-version: 20
           cache: 'pnpm'
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index e7aede5..c3837b1 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -25,18 +25,18 @@ jobs:
       id-token: write
     steps:
       - name: Check out repo
-        uses: actions/checkout@v6
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
         with:
           ref: ${{ github.event.release.tag_name || inputs.tag }}
 
       - name: Set up node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38 # v6.5.0
         with:
           node-version: 20
           registry-url: https://registry.npmjs.org
 
       - name: Set up pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
 
       - name: Install dependencies
         run: pnpm install --frozen-lockfile
@@ -46,24 +46,29 @@ jobs:
 
       - name: Determine publish tag
         id: extract
+        env:
+          RELEASE_TAG: ${{ github.event.release.tag_name }}
+          INPUT_PUBLISH_TAG: ${{ inputs.publish_tag }}
         run: |
-          if [ -n "${{ inputs.publish_tag }}" ]; then
-            PUBLISH_TAG="${{ inputs.publish_tag }}"
+          if [ -n "$INPUT_PUBLISH_TAG" ]; then
+            PUBLISH_TAG="$INPUT_PUBLISH_TAG"
           else
-            FULL_TAG_NAME=${{ github.event.release.tag_name }}
+            FULL_TAG_NAME="$RELEASE_TAG"
             if [[ "$FULL_TAG_NAME" == *"beta"* ]]; then
               PUBLISH_TAG="beta"
             else
               PUBLISH_TAG="latest"
             fi
           fi
-          echo "PUBLISH_TAG=$PUBLISH_TAG" >> $GITHUB_ENV
+          echo "PUBLISH_TAG=$PUBLISH_TAG" >> "$GITHUB_ENV"
 
       - name: Validate tag matches package.json version
+        env:
+          RAW_TAG: ${{ github.event.release.tag_name || inputs.tag }}
         run: |
-          TAG_VERSION="${{ github.event.release.tag_name || inputs.tag }}"
+          TAG_VERSION="$RAW_TAG"
           # Remove package name prefix if present (e.g., @elevenlabs/cli@0.3.1 -> 0.3.1)
-          TAG_VERSION=$(echo "$TAG_VERSION" | sed 's/.*@//')
+          TAG_VERSION="${TAG_VERSION##*@}"
           PACKAGE_JSON_VERSION=$(node -p "require('./package.json').version")
 
           echo "Tag version: $TAG_VERSION"
diff --git a/.github/workflows/test-cli.yml b/.github/workflows/test-cli.yml
index 69ea796..f3ed9c6 100644
--- a/.github/workflows/test-cli.yml
+++ b/.github/workflows/test-cli.yml
@@ -14,13 +14,13 @@ jobs:
     runs-on: ubuntu-latest
     
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
 
       - name: Set up pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '20'
           cache: 'pnpm'
@@ -39,7 +39,7 @@ jobs:
           
       - name: Upload test results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: test-results
           path: coverage/
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 6b4b96e..6e71f65 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -15,13 +15,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Check out repo
-        uses: actions/checkout@v3
+        uses: actions/checkout@a37ce9120846195fa4ece8f58b268e6043cb2f26 # v3.7.0
 
       - name: Set up pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
 
       - name: Set up node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
         with:
           node-version: 20
           cache: 'pnpm'