diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dca6098..5c0a6c4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -31,7 +31,7 @@ jobs:
     name: ASCII source
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Source must be ASCII-only
         run: |
           if git grep -nP '[^\x00-\x7F]' -- '*.hs' '*.c' '*.h' '*.cabal' '*.md' '*.nix' '*.sh'; then
@@ -45,7 +45,7 @@ jobs:
     name: Changelog fragments
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Fragments are well-formed
         run: |
           status=0
@@ -67,11 +67,11 @@ jobs:
     needs: [ascii]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: haskell-actions/hlint-setup@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: haskell-actions/hlint-setup@fe9cd1cd1af94a23900c06738e73f6ddb092966a # v2.4.10
         with:
           version: '3.10'
-      - uses: haskell-actions/hlint-run@v2
+      - uses: haskell-actions/hlint-run@eaca4cfbf4a69f4eb875df38b6bc3e1657020378 # v2.4.10
         with:
           path: '["src/", "test/", "exe/"]'
           fail-on: warning
@@ -81,7 +81,7 @@ jobs:
     needs: [ascii]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Pinned to the version the repo is formatted with: formatting is
       # not stable across ormolu releases, and a floating version would
@@ -98,12 +98,12 @@ jobs:
       # a released run-ormolu points at.
       - name: Cache formatter binary
         id: formatter-cache
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ~/.local/bin/ormolu
           key: ormolu-0.9.0.0-${{ runner.os }}
 
-      - uses: haskell-actions/setup@v2
+      - uses: haskell-actions/setup@0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d # v2.12.1
         if: steps.formatter-cache.outputs.cache-hit != 'true'
         with:
           ghc-version: '9.14.1'
@@ -140,7 +140,7 @@ jobs:
       # Matches the floor of the bzip2-clib bound in nova-cache.cabal.
       BZIP2_CLIB_VERSION: 1.0.8
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Fetch the bundled bzlib.h the build compiles against
         run: |
@@ -177,7 +177,7 @@ jobs:
             name: Windows
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # GHC's macOS bindist names the Command Line Tools SDK as a library
       # directory of its rts, so every link reads that SDK's .tbd stubs
@@ -192,14 +192,14 @@ jobs:
         if: runner.os == 'macOS'
         run: sudo xcode-select -s /Library/Developer/CommandLineTools
 
-      - uses: haskell-actions/setup@v2
+      - uses: haskell-actions/setup@0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d # v2.12.1
         id: setup
         with:
           ghc-version: '9.14.1'
           cabal-version: 'latest'
 
       - name: Cache Cabal store
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ steps.setup.outputs.cabal-store }}
           key: cabal-${{ runner.os }}-${{ hashFiles('nova-cache.cabal') }}
@@ -226,8 +226,8 @@ jobs:
     needs: [lint, format, c99-lint]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: haskell-actions/setup@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: haskell-actions/setup@0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d # v2.12.1
         with:
           ghc-version: '9.14.1'
           cabal-version: 'latest'
@@ -245,16 +245,16 @@ jobs:
     needs: [lint, format]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: haskell-actions/setup@v2
+      - uses: haskell-actions/setup@0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d # v2.12.1
         id: setup
         with:
           ghc-version: '9.14.1'
           cabal-version: 'latest'
 
       - name: Cache Cabal store
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ steps.setup.outputs.cabal-store }}
           key: cabal-sdist-${{ hashFiles('nova-cache.cabal') }}
@@ -283,9 +283,9 @@ jobs:
     needs: [cabal-check]
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: haskell-actions/setup@v2
+      - uses: haskell-actions/setup@0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d # v2.12.1
         id: setup
         with:
           ghc-version: '9.14.1'
@@ -296,7 +296,7 @@ jobs:
       # different set than the matrix build's.  Dependencies land in it
       # unsanitized - the flags below are scoped to this package alone.
       - name: Cache Cabal store
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ steps.setup.outputs.cabal-store }}
           key: cabal-sanitize-${{ hashFiles('nova-cache.cabal') }}
@@ -360,16 +360,16 @@ jobs:
     needs: [build]
     runs-on: ubuntu-24.04-arm
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - uses: haskell-actions/setup@v2
+      - uses: haskell-actions/setup@0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d # v2.12.1
         id: setup
         with:
           ghc-version: '9.14.1'
           cabal-version: 'latest'
 
       - name: Cache Cabal store
-        uses: actions/cache@v6
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           path: ${{ steps.setup.outputs.cabal-store }}
           key: cabal-deploy-arm-${{ hashFiles('nova-cache.cabal') }}
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index 387c0ad..d3071fd 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -21,7 +21,7 @@ jobs:
     name: Upload docs to Hackage
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ inputs.tag }}
 
@@ -33,7 +33,7 @@ jobs:
           TAG_VERSION=${TAG_VERSION#v}
           sed -i "s/^version:.*/version:            $TAG_VERSION/" nova-cache.cabal
 
-      - uses: haskell-actions/setup@v2
+      - uses: haskell-actions/setup@0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d # v2.12.1
         with:
           ghc-version: '9.14.1'
           cabal-version: 'latest'
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index ac9ba56..9e85eab 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -22,7 +22,7 @@ jobs:
     needs: ci
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # A Hackage tarball is immutable, so whatever heading the changelog
       # carries is frozen into the release.  Nothing is uploaded unless the
@@ -46,7 +46,7 @@ jobs:
           TAG_VERSION=${GITHUB_REF#refs/tags/v}
           sed -i "s/^version:.*/version:            $TAG_VERSION/" nova-cache.cabal
           echo "Set version to $TAG_VERSION"
-      - uses: haskell-actions/setup@v2
+      - uses: haskell-actions/setup@0f8e8c99d88aeb3fbfd523f1ef2c6f762d10d64d # v2.12.1
         with:
           ghc-version: '9.14.1'
           cabal-version: 'latest'
diff --git a/README.md b/README.md
index f6391ca..08bf362 100644
--- a/README.md
+++ b/README.md
@@ -153,10 +153,11 @@ nova-cache-server reclaim-nars --store /var/lib/nix-cache --delete  # remove
 
 ### Public cache
 
-A public instance runs at `cache.novavero.ai`. It serves the closure of
-nova-nix's Windows `hello` recipe, which nova-nix's CI publishes on every push
-to its main branch. To use it from Nix, add it to `/etc/nix/nix.conf`. On a
-multi-user install, Nix ignores substituters set by users it does not trust.
+A public instance runs at `cache.novavero.ai`. It serves the sources
+nova-nix's Windows packages are built from and the closure of its Windows
+`hello` recipe, which nova-nix's CI publishes on every push to its main
+branch. To use it from Nix, add it to `/etc/nix/nix.conf`. On a multi-user
+install, Nix ignores substituters set by users it does not trust.
 
 ```
 extra-substituters = https://cache.novavero.ai