diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 7bc65a7..9d63658 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -12,7 +12,7 @@ jobs:
   stale:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/stale@v10
+      - uses: actions/stale@1e223db275d687790206a7acac4d1a11bd6fe629 # v10.4.0
         with:
           stale-issue-message: 'This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 7 days if no further activity occurs.'
           stale-pr-message: 'This PR has been automatically marked as stale because it has not had recent activity. It will be closed in 7 days if no further activity occurs.'
diff --git a/.github/workflows/welcome.yml b/.github/workflows/welcome.yml
index 8b310f9..8acbe1f 100644
--- a/.github/workflows/welcome.yml
+++ b/.github/workflows/welcome.yml
@@ -13,7 +13,7 @@ jobs:
   welcome:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/first-interaction@v3
+      - uses: actions/first-interaction@1c4688942c71f71d4f5502a26ea67c331730fa4d # v3.1.0
         with:
           repo_token: ${{ secrets.GITHUB_TOKEN }}
           issue_message: |
diff --git a/CHANGELOG.md b/CHANGELOG.md
index a37887e..c6067f2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,11 @@
 
 All notable changes to the organization profile and community health repository will be documented in this file.
 
+## [Unreleased] - 2026-09-20
+
+### Security
+- Re-pinned `actions/stale` to the verified immutable commit for `v10.4.0` and `actions/first-interaction` to the verified immutable commit for `v3.1.0`. This pinning was introduced on 2026-09-05 but was silently reverted to mutable version tags (`@v10`, `@v3`) by the unrelated 2026-09-09 profile update; restored here from the local `main` branch as a certified foreign change (behavior and triggers unchanged).
+
 ## [1.1.3] - 2026-08-17
 
 ### Changed