diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
index df1ae4306..e43266e06 100644
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -17,48 +17,48 @@ jobs:
     timeout-minutes: 5
     name: "'${{ matrix.toxenv }}' on py${{ matrix.py }}"
     steps:
-      - uses: actions/checkout@v7
-
-      - name: get date for caching
-        run: /bin/date -u "+%U" > cachedate.txt
-        shell: bash
-
-      - uses: actions/setup-python@v7
-        with:
-          python-version: "${{ matrix.py }}"
-          cache: "pip"
-          cache-dependency-path: |
-            .github/workflows/build.yaml
-            pyproject.toml
-            tox.ini
-            cachedate.txt
-
-      - run: python -m pip install tox tox-uv
-
-      - run: python -m tox run -e "${{ matrix.toxenv }}"
+      - parallel:
+        - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+          with:
+            persist-credentials: false
+        - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+          with:
+            python-version: "${{ matrix.py }}"
+        - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+
+      - run: uv tool install 'tox' --with 'tox-uv'
+      - run: tox run -e "${{ matrix.toxenv }}"
 
   # run tests after building an sdist and unpacking it
   test-sdist:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
-        with:
-          python-version: "3.x"
-      - name: install requirements
-        run: python -m pip install build tox tox-uv
+      - parallel:
+        - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+          with:
+            persist-credentials: false
+        - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+          with:
+            python-version: "3.x"
+        - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
+
+      - parallel:
+        - run: uv tool install 'tox' --with 'tox-uv'
+        - run: uv tool install 'build'
+        - run: uv tool install 'mddj'
+
       - name: build and unpack sdist
         run: |
-          python -m build --sdist
-          version="$(grep '^version' pyproject.toml | head -n1 | cut -d'"' -f2)"
+          pyproject-build --sdist
+          version="$(mddj read version)"
           cd dist
           tar -xzf "check_jsonschema-${version}.tar.gz"
       - name: test
         run: |
-          version="$(grep '^version' pyproject.toml | head -n1 | cut -d'"' -f2)"
+          version="$(mddj read version)"
           cd "dist/check_jsonschema-${version}"
-          python -m tox run -m ci
+          tox run -m ci
 
   ci-test-matrix:
     strategy:
@@ -69,41 +69,23 @@ jobs:
     runs-on: "${{ matrix.os }}-latest"
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v7
+      - parallel:
+        - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+          with:
+            persist-credentials: false
+        - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+          with:
+            python-version: "${{ matrix.py }}"
+        - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
 
-      - name: get date for caching
-        run: /bin/date -u "+%U" > cachedate.txt
-        shell: bash
-
-      - uses: actions/setup-python@v7
-        id: setup-python
-        with:
-          python-version: ${{ matrix.py }}
-          cache: "pip"
-          cache-dependency-path: |
-            .github/workflows/build.yaml
-            pyproject.toml
-            tox.ini
-            cachedate.txt
-
-      - run: python -m pip install tox tox-uv
-
-      - name: cache tox virtualenvs
-        uses: actions/cache@v6
-        with:
-          path: .tox
-          key: >
-            tox
-            os=${{ runner.os }}
-            python=${{ steps.setup-python.outputs.python-version }}
-            hash=${{ hashFiles('.github/workflows/build.yaml', 'pyproject.toml', 'tox.ini', 'cachedate.txt') }}
+      - run: uv tool install 'tox' --with 'tox-uv'
 
       - name: test
         run: |
-          python -m tox run -m ci -- --junitxml pytest.{envname}.xml
-          python -m tox run -e cov_combine,cov_report
+          tox run -m ci -- --junitxml pytest.{envname}.xml
+          tox run -e cov_combine,cov_report
 
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: pytest-report-py${{ matrix.py }}-${{ matrix.os }}
           path: pytest.*.xml
@@ -114,14 +96,16 @@ jobs:
     timeout-minutes: 5
     name: "Collate results to check for skipped tests"
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
-        with:
-          python-version: "3.x"
-      # download everything
-      - uses: actions/download-artifact@v8
-        with:
-          path: artifacts/
+      - parallel:
+        - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+          with:
+            persist-credentials: false
+        - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+          with:
+            python-version: "3.x"
+        - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+          with:
+            path: artifacts/
       # collate and report
       - run: python ./scripts/aggregate-pytest-reports.py artifacts/*/pytest.*.xml
 
@@ -133,24 +117,16 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v7
+      - parallel:
+        - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+          with:
+            persist-credentials: false
+        - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+          with:
+            python-version: "${{ matrix.py }}"
+        - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
 
-      - name: get date for caching
-        run: /bin/date -u "+%U" > cachedate.txt
-        shell: bash
-
-      - uses: actions/setup-python@v7
-        id: setup-python
-        with:
-          python-version: "3.x"
-          cache: "pip"
-          cache-dependency-path: |
-            .github/workflows/build.yaml
-            pyproject.toml
-            tox.ini
-            cachedate.txt
-
-      - run: python -m pip install tox tox-uv
+      - run: uv tool install 'tox' --with 'tox-uv'
 
       - name: regenerate hook config
         run: tox run -e generate-hooks-config
@@ -163,21 +139,13 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: actions/checkout@v7
-
-      - name: get date for caching
-        run: /bin/date -u "+%U" > cachedate.txt
-        shell: bash
-
-      - uses: actions/setup-python@v7
-        with:
-          python-version: "3.x"
-          cache: "pip"
-          cache-dependency-path: |
-            .github/workflows/build.yaml
-            pyproject.toml
-            tox.ini
-            cachedate.txt
+      - parallel:
+        - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+          with:
+            persist-credentials: false
+        - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+          with:
+            python-version: "3.x"
 
       - name: install from source
         run: python -m pip install .
diff --git a/.github/workflows/cron.yaml b/.github/workflows/cron.yaml
index 36656608c..3a6551714 100644
--- a/.github/workflows/cron.yaml
+++ b/.github/workflows/cron.yaml
@@ -11,24 +11,29 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-    - uses: actions/checkout@v7
-    - uses: actions/setup-python@v7
-      with:
-        python-version: '3.x'
+      - parallel:
+        - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+          with:
+            persist-credentials: false
+        - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
+          with:
+            python-version: "3.x"
+        - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
 
-    - name: install tox, uv, and just
-      run: python -m pip install 'tox' 'tox-uv' 'uv' 'rust-just'
+      - parallel:
+        - run: uv tool install 'tox' --with 'tox-uv'
+        - run: uv tool install 'rust-just'
 
-    - name: vendor-schemas
-      run: just vendor-schemas
+      - name: vendor-schemas
+        run: just vendor-schemas
 
-    # this action seems to have significant usage, so it should be stable
-    # can always re-implement with `git status --porcelain`, etc. if necessary
-    - name: Create Pull Request
-      uses: peter-evans/create-pull-request@v8
-      with:
-        title: 'Update vendored schemas'
-        commit-message: '[vendor-schemas] automated update'
-        branch: vendor-schemas-auto
-        reviewers: sirosen
-        body: ''
+      # this action seems to have significant usage, so it should be stable
+      # can always re-implement with `git status --porcelain`, etc. if necessary
+      - name: Create Pull Request
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          title: 'Update vendored schemas'
+          commit-message: '[vendor-schemas] automated update'
+          branch: vendor-schemas-auto
+          reviewers: sirosen
+          body: ''
diff --git a/.github/workflows/publish_to_pypi.yaml b/.github/workflows/publish_to_pypi.yaml
index 3e3218c6d..0d80b8b08 100644
--- a/.github/workflows/publish_to_pypi.yaml
+++ b/.github/workflows/publish_to_pypi.yaml
@@ -10,20 +10,26 @@ jobs:
     timeout-minutes: 5
 
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
-        with:
-          python-version: "3.15"
+      - parallel:
+        - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+          with:
+            persist-credentials: false
+        - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+          with:
+            python-version: "3.15"
+        - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
 
-      - run: python -m pip install build twine
+      - parallel:
+        - run: uv tool install 'build'
+        - run: uv tool install 'twine'
 
       - name: Build Dists
-        run: python -m build .
+        run: pyproject-build .
 
       - name: Check Dists (twine)
         run: twine check dist/*
 
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: packages
           path: dist/*
@@ -37,7 +43,7 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: packages
           path: dist
@@ -51,7 +57,7 @@ jobs:
     timeout-minutes: 5
 
     steps:
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: packages
           path: dist
diff --git a/.github/workflows/publish_to_test_pypi.yaml b/.github/workflows/publish_to_test_pypi.yaml
index 390584802..a9c22e372 100644
--- a/.github/workflows/publish_to_test_pypi.yaml
+++ b/.github/workflows/publish_to_test_pypi.yaml
@@ -17,12 +17,18 @@ jobs:
     timeout-minutes: 5
 
     steps:
-      - uses: actions/checkout@v7
-      - uses: actions/setup-python@v7
-        with:
-          python-version: "3.15"
+      - parallel:
+        - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+          with:
+            persist-credentials: false
+        - uses: actions/setup-python@6d4fd22b20465ccc0f7354476588e8df7c9ca0e0 # v7.1.0
+          with:
+            python-version: "3.15"
+        - uses: astral-sh/setup-uv@c18668ad3cf93ea998bef934396af7bb5c839dc7 # v10.2.0
 
-      - run: python -m pip install build twine
+      - parallel:
+        - run: uv tool install 'build'
+        - run: uv tool install 'twine'
 
       - name: Set dev version prior to upload (auto)
         if: ${{ github.event.inputs.devNumber == '' }}
@@ -33,12 +39,12 @@ jobs:
         run: python ./scripts/set-dev-version.py -n ${{ github.event.inputs.devNumber }}
 
       - name: Build Dists
-        run: python -m build .
+        run: pyproject-build .
 
       - name: Check Dists (twine)
         run: twine check dist/*
 
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: packages
           path: dist/*
@@ -53,7 +59,7 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           name: packages
           path: dist