diff --git a/.github/workflows/reusable-python-security.yml b/.github/workflows/reusable-python-security.yml
index a9457a9..9990c38 100644
--- a/.github/workflows/reusable-python-security.yml
+++ b/.github/workflows/reusable-python-security.yml
@@ -11,8 +11,8 @@ jobs:
   static-and-deps:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4                 # TODO: pin to commit SHA before merge
-      - uses: actions/setup-python@v5             # TODO: pin to commit SHA before merge
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
           python-version: "${{ inputs.python-version }}"
       - run: pip install ruff mypy bandit pip-audit cyclonedx-bom
@@ -26,7 +26,7 @@ jobs:
         run: pip-audit
       - name: SBOM (CycloneDX)
         run: cyclonedx-py environment -o sbom.json || true
-      - uses: actions/upload-artifact@v4          # TODO: pin to commit SHA before merge
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: sbom
           path: sbom.json
diff --git a/docs/security-baseline.md b/docs/security-baseline.md
index 93cb5b4..2f25dff 100644
--- a/docs/security-baseline.md
+++ b/docs/security-baseline.md
@@ -25,6 +25,6 @@ Each repo should also carry, matching cmcp / ca2a / agent-manifest:
 
 Copy-paste versions of these, plus the org-level settings (secret scanning, push protection, Dependabot alerts, and the branch-protection ruleset), are in the internal security hardening bundle.
 
-## Note
+## Action pinning
 
-All third-party actions must be pinned to a commit SHA before merge. The reusable workflow currently uses version tags marked with `TODO`.
+All actions first-party (`actions/*`) and third-party (e.g. `anchore/sbom-action`) are pinned to a commit SHA with a `# vX.Y.Z` comment for readability. This applies org-wide; see `reusable-python-security.yml` and `sbom.yml` in cmcp / ca2a / trace-spec for the pattern. When bumping a version, update both the SHA and the comment together.