diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index c164c3c4fa39..085dbcec2565 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -31,7 +31,7 @@ jobs:
       ci: ${{ steps.filter.outputs.ci }}
     steps:
     - uses: actions/checkout@v4
-    - uses: dorny/paths-filter@v3
+    - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
       id: filter
       with:
         # we want to run tests if source code is changed or the scripts
@@ -121,7 +121,7 @@ jobs:
     outputs:
       packages: ${{ steps.filter.outputs.changes }}
     steps:
-    - uses: dorny/paths-filter@v4
+    - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
       id: filter
       with:
         # For each library, run CI in split repos where there are changes in:
diff --git a/.github/workflows/google-auth-library-java-ci.yaml b/.github/workflows/google-auth-library-java-ci.yaml
index 80fc12a45aed..39e584d3b6a5 100644
--- a/.github/workflows/google-auth-library-java-ci.yaml
+++ b/.github/workflows/google-auth-library-java-ci.yaml
@@ -28,7 +28,7 @@ jobs:
       library: ${{ steps.filter.outputs.library }}
     steps:
     - uses: actions/checkout@v4
-    - uses: dorny/paths-filter@v3
+    - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
       id: filter
       with:
         filters: |
diff --git a/.github/workflows/java-bigquery-scorecard.yml b/.github/workflows/java-bigquery-scorecard.yml
index 12b3ccc56bfa..d2063b876cce 100644
--- a/.github/workflows/java-bigquery-scorecard.yml
+++ b/.github/workflows/java-bigquery-scorecard.yml
@@ -26,7 +26,7 @@ jobs:
       library: ${{ steps.filter.outputs.library }}
     steps:
     - uses: actions/checkout@v4
-    - uses: dorny/paths-filter@v3
+    - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
       id: filter
       with:
         filters: |
diff --git a/.github/workflows/java-spanner-integration-tests-against-emulator.yaml b/.github/workflows/java-spanner-integration-tests-against-emulator.yaml
index f43cc1c5bf21..36f2f467f6b5 100644
--- a/.github/workflows/java-spanner-integration-tests-against-emulator.yaml
+++ b/.github/workflows/java-spanner-integration-tests-against-emulator.yaml
@@ -11,7 +11,7 @@ jobs:
       library: ${{ steps.filter.outputs.library }}
     steps:
     - uses: actions/checkout@v4
-    - uses: dorny/paths-filter@v3
+    - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
       id: filter
       with:
         filters: |
diff --git a/.github/workflows/java-spanner-jdbc-ci.yaml b/.github/workflows/java-spanner-jdbc-ci.yaml
index 03e2c8a8f4a1..7277662f729c 100644
--- a/.github/workflows/java-spanner-jdbc-ci.yaml
+++ b/.github/workflows/java-spanner-jdbc-ci.yaml
@@ -28,7 +28,7 @@ jobs:
       library: ${{ steps.filter.outputs.library }}
     steps:
     - uses: actions/checkout@v4
-    - uses: dorny/paths-filter@v3
+    - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
       id: filter
       with:
         filters: |
diff --git a/.github/workflows/java-spanner-jdbc-integration-tests-against-emulator.yaml b/.github/workflows/java-spanner-jdbc-integration-tests-against-emulator.yaml
index cddffc081038..896957eeaddb 100644
--- a/.github/workflows/java-spanner-jdbc-integration-tests-against-emulator.yaml
+++ b/.github/workflows/java-spanner-jdbc-integration-tests-against-emulator.yaml
@@ -13,7 +13,7 @@ jobs:
       library: ${{ steps.filter.outputs.library }}
     steps:
     - uses: actions/checkout@v4
-    - uses: dorny/paths-filter@v3
+    - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
       id: filter
       with:
         filters: |
diff --git a/.github/workflows/java-spanner-jdbc-quickperf.yaml b/.github/workflows/java-spanner-jdbc-quickperf.yaml
index df72be92aa90..e1759fb32dd6 100644
--- a/.github/workflows/java-spanner-jdbc-quickperf.yaml
+++ b/.github/workflows/java-spanner-jdbc-quickperf.yaml
@@ -25,7 +25,7 @@ jobs:
       library: ${{ steps.filter.outputs.library }}
     steps:
     - uses: actions/checkout@v4
-    - uses: dorny/paths-filter@v3
+    - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
       id: filter
       with:
         filters: |
diff --git a/.github/workflows/java-spanner-jdbc-sample-tests.yml b/.github/workflows/java-spanner-jdbc-sample-tests.yml
index b3f74ed088b8..a465a243630f 100644
--- a/.github/workflows/java-spanner-jdbc-sample-tests.yml
+++ b/.github/workflows/java-spanner-jdbc-sample-tests.yml
@@ -25,7 +25,7 @@ jobs:
       library: ${{ steps.filter.outputs.library }}
     steps:
     - uses: actions/checkout@v4
-    - uses: dorny/paths-filter@v3
+    - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
       id: filter
       with:
         filters: |
diff --git a/.github/workflows/java-spanner-jdbc-spring-data-jdbc-sample.yaml b/.github/workflows/java-spanner-jdbc-spring-data-jdbc-sample.yaml
index 78e014263f6c..385e5b2659a9 100644
--- a/.github/workflows/java-spanner-jdbc-spring-data-jdbc-sample.yaml
+++ b/.github/workflows/java-spanner-jdbc-spring-data-jdbc-sample.yaml
@@ -25,7 +25,7 @@ jobs:
       library: ${{ steps.filter.outputs.library }}
     steps:
     - uses: actions/checkout@v4
-    - uses: dorny/paths-filter@v3
+    - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
       id: filter
       with:
         filters: |
diff --git a/.github/workflows/java-spanner-jdbc-spring-data-mybatis-sample.yaml b/.github/workflows/java-spanner-jdbc-spring-data-mybatis-sample.yaml
index 3673de7259cc..e91ac04b47a1 100644
--- a/.github/workflows/java-spanner-jdbc-spring-data-mybatis-sample.yaml
+++ b/.github/workflows/java-spanner-jdbc-spring-data-mybatis-sample.yaml
@@ -25,7 +25,7 @@ jobs:
       library: ${{ steps.filter.outputs.library }}
     steps:
     - uses: actions/checkout@v4
-    - uses: dorny/paths-filter@v3
+    - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
       id: filter
       with:
         filters: |
diff --git a/.github/workflows/java-storage-nio-ci.yaml b/.github/workflows/java-storage-nio-ci.yaml
index ca1c4fecf691..857fc2cee181 100644
--- a/.github/workflows/java-storage-nio-ci.yaml
+++ b/.github/workflows/java-storage-nio-ci.yaml
@@ -28,7 +28,7 @@ jobs:
       library: ${{ steps.filter.outputs.library }}
     steps:
     - uses: actions/checkout@v4
-    - uses: dorny/paths-filter@v3
+    - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
       id: filter
       with:
         filters: |
diff --git a/.github/workflows/sdk-platform-java-analyze_dependency.yaml b/.github/workflows/sdk-platform-java-analyze_dependency.yaml
index 89e67a44fbae..6e4b8a45d53b 100644
--- a/.github/workflows/sdk-platform-java-analyze_dependency.yaml
+++ b/.github/workflows/sdk-platform-java-analyze_dependency.yaml
@@ -26,7 +26,7 @@ jobs:
       library: ${{ steps.filter.outputs.library }}
     steps:
     - uses: actions/checkout@v4
-    - uses: dorny/paths-filter@v3
+    - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
       id: filter
       with:
         filters: |
diff --git a/.github/workflows/sdk-platform-java-ci.yaml b/.github/workflows/sdk-platform-java-ci.yaml
index 3cbd1f2c0741..e66dc1d79cfb 100644
--- a/.github/workflows/sdk-platform-java-ci.yaml
+++ b/.github/workflows/sdk-platform-java-ci.yaml
@@ -11,7 +11,7 @@ jobs:
       library: ${{ steps.filter.outputs.library }}
     steps:
     - uses: actions/checkout@v4
-    - uses: dorny/paths-filter@v3
+    - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
       id: filter
       with:
         filters: |
diff --git a/.github/workflows/sdk-platform-java-dependency_compatibility_test.yaml b/.github/workflows/sdk-platform-java-dependency_compatibility_test.yaml
index 31e1dece4a04..e04b4c282802 100644
--- a/.github/workflows/sdk-platform-java-dependency_compatibility_test.yaml
+++ b/.github/workflows/sdk-platform-java-dependency_compatibility_test.yaml
@@ -23,7 +23,7 @@ jobs:
       library: ${{ steps.filter.outputs.library }}
     steps:
     - uses: actions/checkout@v4
-    - uses: dorny/paths-filter@v3
+    - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
       id: filter
       with:
         filters: |
diff --git a/.github/workflows/sdk-platform-java-downstream.yaml b/.github/workflows/sdk-platform-java-downstream.yaml
index dfcce294f465..6fb3b4aa2fea 100644
--- a/.github/workflows/sdk-platform-java-downstream.yaml
+++ b/.github/workflows/sdk-platform-java-downstream.yaml
@@ -17,7 +17,7 @@ jobs:
       library: ${{ steps.filter.outputs.library }}
     steps:
     - uses: actions/checkout@v4
-    - uses: dorny/paths-filter@v3
+    - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
       id: filter
       with:
         filters: |
diff --git a/.github/workflows/sdk-platform-java-downstream_unmanaged_dependency_check.yaml b/.github/workflows/sdk-platform-java-downstream_unmanaged_dependency_check.yaml
index 8fcc672ecc1d..e68610513e00 100644
--- a/.github/workflows/sdk-platform-java-downstream_unmanaged_dependency_check.yaml
+++ b/.github/workflows/sdk-platform-java-downstream_unmanaged_dependency_check.yaml
@@ -17,7 +17,7 @@ jobs:
       library: ${{ steps.filter.outputs.library }}
     steps:
     - uses: actions/checkout@v4
-    - uses: dorny/paths-filter@v3
+    - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
       id: filter
       with:
         filters: |
diff --git a/.github/workflows/sdk-platform-java-java_compatibility_check.yaml b/.github/workflows/sdk-platform-java-java_compatibility_check.yaml
index 9684dbd134e6..cdbc2d3820c9 100644
--- a/.github/workflows/sdk-platform-java-java_compatibility_check.yaml
+++ b/.github/workflows/sdk-platform-java-java_compatibility_check.yaml
@@ -25,7 +25,7 @@ jobs:
       library: ${{ steps.filter.outputs.library }}
     steps:
     - uses: actions/checkout@v4
-    - uses: dorny/paths-filter@v3
+    - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
       id: filter
       with:
         filters: |
diff --git a/.github/workflows/sdk-platform-java-shared_dependencies.yaml b/.github/workflows/sdk-platform-java-shared_dependencies.yaml
index 19e0fe320921..4b5ebba871ce 100644
--- a/.github/workflows/sdk-platform-java-shared_dependencies.yaml
+++ b/.github/workflows/sdk-platform-java-shared_dependencies.yaml
@@ -17,7 +17,7 @@ jobs:
       library: ${{ steps.filter.outputs.library }}
     steps:
     - uses: actions/checkout@v4
-    - uses: dorny/paths-filter@v3
+    - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
       id: filter
       with:
         filters: |
diff --git a/.github/workflows/sdk-platform-java-sonar.yaml b/.github/workflows/sdk-platform-java-sonar.yaml
index 23063c3cdb1a..aa8fa4f99d40 100644
--- a/.github/workflows/sdk-platform-java-sonar.yaml
+++ b/.github/workflows/sdk-platform-java-sonar.yaml
@@ -14,7 +14,7 @@ jobs:
       library: ${{ steps.filter.outputs.library }}
     steps:
     - uses: actions/checkout@v4
-    - uses: dorny/paths-filter@v3
+    - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
       id: filter
       with:
         filters: |
diff --git a/.github/workflows/sdk-platform-java-verify_library_generation.yaml b/.github/workflows/sdk-platform-java-verify_library_generation.yaml
index 46b0b6092b1e..fb2e565cec54 100644
--- a/.github/workflows/sdk-platform-java-verify_library_generation.yaml
+++ b/.github/workflows/sdk-platform-java-verify_library_generation.yaml
@@ -11,7 +11,7 @@ jobs:
       library: ${{ steps.filter.outputs.library }}
     steps:
     - uses: actions/checkout@v4
-    - uses: dorny/paths-filter@v3
+    - uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
       id: filter
       with:
         filters: |