diff --git a/.github/workflows/benchmarks.yml b/.github/workflows/benchmarks.yml
index d7378245a..6871aa577 100644
--- a/.github/workflows/benchmarks.yml
+++ b/.github/workflows/benchmarks.yml
@@ -12,10 +12,10 @@ jobs:
       contents: read
     runs-on: self-hosted
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2023-06-27
           override: true
@@ -29,10 +29,10 @@ jobs:
     runs-on: self-hosted
     needs: [bench_poseidon]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2023-06-27
           override: true
@@ -46,10 +46,10 @@ jobs:
     runs-on: self-hosted
     needs: [bench_poseidon]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2023-06-27
           override: true
@@ -63,10 +63,10 @@ jobs:
     runs-on: self-hosted
     needs: [bench_poseidon]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2023-06-27
           override: true
@@ -80,10 +80,10 @@ jobs:
     runs-on: self-hosted
     needs: [bench_poseidon]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2023-06-27
           override: true
@@ -97,10 +97,10 @@ jobs:
     runs-on: self-hosted
     needs: [bench_poseidon]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2023-06-27
           override: true
@@ -114,10 +114,10 @@ jobs:
     runs-on: self-hosted
     needs: [bench_poseidon]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2023-06-27
           override: true
@@ -131,10 +131,10 @@ jobs:
     runs-on: self-hosted
     needs: [bench_poseidon]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2023-06-27
           override: true
@@ -148,10 +148,10 @@ jobs:
     runs-on: self-hosted
     needs: [bench_poseidon]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2023-06-27
           override: true
@@ -165,10 +165,10 @@ jobs:
     runs-on: self-hosted
     needs: [bench_poseidon]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2023-06-27
           override: true
@@ -182,10 +182,10 @@ jobs:
     runs-on: self-hosted
     needs: [bench_poseidon]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2023-06-27
           override: true
diff --git a/.github/workflows/engine.yml b/.github/workflows/engine.yml
index ae573dd30..60a5e3f90 100644
--- a/.github/workflows/engine.yml
+++ b/.github/workflows/engine.yml
@@ -24,15 +24,15 @@ jobs:
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/')
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2024-07-18
           override: true
           components: rustfmt, clippy
-      - uses: jetli/wasm-pack-action@v0.4.0
+      - uses: jetli/wasm-pack-action@0d096b08b4e5a7de8c28de67e11e945404e9eefa  #v0.4.0
         with:
           # Pin to version 0.12.1
           version: 'v0.12.1'
@@ -176,7 +176,7 @@ jobs:
           curl -s "https://raw.githubusercontent.com/zkonduit/ezkljs-engine/main/README.md" > ./pkg/README.md
 
       - name: Set up Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7  #v3.8.2
         with:
           node-version: "18.12.1"
           registry-url: "https://registry.npmjs.org"
@@ -201,7 +201,7 @@ jobs:
         RELEASE_TAG: ${{ github.ref_name }}
     if: startsWith(github.ref, 'refs/tags/')
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
       - name: Update version in package.json
@@ -230,13 +230,13 @@ jobs:
           NR==30{$0="    specifier: \"" tag "\""}
           NR==31{$0="    version: \"" tag "\""}
           NR==400{$0="  /@ezkljs/engine@" tag ":"}
-          NR==401{$0="    resolution: {integrity: \"" integrity "\"}"} 1' in-browser-evm-verifier/pnpm-lock.yaml > temp.yaml && mv temp.yaml in-browser-evm-verifier/pnpm-lock.yaml  
+          NR==401{$0="    resolution: {integrity: \"" integrity "\"}"} 1' in-browser-evm-verifier/pnpm-lock.yaml > temp.yaml && mv temp.yaml in-browser-evm-verifier/pnpm-lock.yaml
       - name: Use pnpm 8
-        uses: pnpm/action-setup@v2
+        uses: pnpm/action-setup@eae0cfeb286e66ffb5155f1a79b90583a127a68b  #v2.4.1
         with:
           version: 8
       - name: Set up Node.js
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7  #v3.8.2
         with:
           node-version: "18.12.1"
           registry-url: "https://registry.npmjs.org"
@@ -247,4 +247,4 @@ jobs:
           pnpm run build
           pnpm publish --no-git-checks
         env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}  
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/.github/workflows/large-tests.yml b/.github/workflows/large-tests.yml
index 99a13364e..2aac6a0f2 100644
--- a/.github/workflows/large-tests.yml
+++ b/.github/workflows/large-tests.yml
@@ -10,10 +10,10 @@ jobs:
       contents: read
     runs-on: kaiju
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2024-07-18
           override: true
diff --git a/.github/workflows/pypi-gpu.yml b/.github/workflows/pypi-gpu.yml
index 1d628963a..e598a2a42 100644
--- a/.github/workflows/pypi-gpu.yml
+++ b/.github/workflows/pypi-gpu.yml
@@ -28,37 +28,36 @@ jobs:
     env:
       RELEASE_TAG: ${{ github.ref_name }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@b64ffcaf5b410884ad320a9cfac8866006a109aa  #v4.8.0
         with:
           python-version: 3.12
           architecture: x64
 
-      - name: Set pyproject.toml version to match github tag
+      - name: Set pyproject.toml version to match github tag and rename ezkl to ezkl-gpu
         shell: bash
         run: |
             mv pyproject.toml pyproject.toml.orig
-            sed "s/ezkl/ezkl-gpu/" pyproject.toml.orig >pyproject.toml
-            sed "s/0\\.0\\.0/${RELEASE_TAG//v}/" pyproject.toml.orig >pyproject.toml
+            sed "s/ezkl/ezkl-gpu/" pyproject.toml.orig > pyproject.toml.tmp
+            sed "s/0\\.0\\.0/${RELEASE_TAG//v}/" pyproject.toml.tmp > pyproject.toml
 
-      - name: rename ezkl.pyi to ezkl-gpu.pyi
-        run: mv ezkl.pyi ezkl-gpu.pyi
-
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2023-06-27
           override: true
           components: rustfmt, clippy
 
-      - name: Set Cargo.toml version to match github tag
+      - name: Set Cargo.toml version to match github tag and rename ezkl to ezkl-gpu
         shell: bash
+        # the ezkl substitution here looks for the first instance of name = "ezkl" and changes it to "ezkl-gpu"
         run: |
           mv Cargo.toml Cargo.toml.orig
-          sed "s/0\\.0\\.0/${RELEASE_TAG//v}/" Cargo.toml.orig >Cargo.toml
+          sed "0,/name = \"ezkl\"/s/name = \"ezkl\"/name = \"ezkl-gpu\"/" Cargo.toml.orig > Cargo.toml.tmp
+          sed "s/0\\.0\\.0/${RELEASE_TAG//v}/" Cargo.toml.tmp > Cargo.toml
           mv Cargo.lock Cargo.lock.orig
-          sed "s/0\\.0\\.0/${RELEASE_TAG//v}/" Cargo.lock.orig >Cargo.lock
+          sed "s/0\\.0\\.0/${RELEASE_TAG//v}/" Cargo.lock.orig > Cargo.lock
 
       - name: Install required libraries
         shell: bash
@@ -66,7 +65,7 @@ jobs:
           sudo apt-get update && sudo apt-get install -y openssl pkg-config libssl-dev
 
       - name: Build wheels
-        uses: PyO3/maturin-action@v1
+        uses: PyO3/maturin-action@5f8a1b3b0aad13193f46c9131f9b9e663def8ce5  #v1.46.0
         with:
           target: ${{ matrix.target }}
           manylinux: auto
@@ -79,7 +78,7 @@ jobs:
           pip install ezkl-gpu --no-index --find-links dist --force-reinstall
 
       - name: Upload wheels
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08  #v4.6.0
         with:
           name: wheels
           path: dist
@@ -95,7 +94,7 @@ jobs:
     # needs: [ macos, windows, linux, linux-cross, musllinux, musllinux-cross ]
     needs: [linux]
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16  #v4.1.8
         with:
           name: wheels
       - name: List Files
@@ -107,14 +106,14 @@ jobs:
       # publishes to PyPI
       - name: Publish package distributions to PyPI
         continue-on-error: true
-        uses: pypa/gh-action-pypi-publish@unstable/v1
+        uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc  #v1.12.4
         with:
           packages-dir: ./wheels
 
       # publishes to TestPyPI
       - name: Publish package distribution to TestPyPI
         continue-on-error: true
-        uses: pypa/gh-action-pypi-publish@unstable/v1
+        uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc  #v1.12.4
         with:
           repository-url: https://test.pypi.org/legacy/
           packages-dir: ./wheels
diff --git a/.github/workflows/pypi.yml b/.github/workflows/pypi.yml
index 261eb7b74..bba90268d 100644
--- a/.github/workflows/pypi.yml
+++ b/.github/workflows/pypi.yml
@@ -26,10 +26,10 @@ jobs:
     env:
         RELEASE_TAG: ${{ github.ref_name }}
     steps:
-      - uses: actions/checkout@v4
-        with: 
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
+        with:
           persist-credentials: false
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@b64ffcaf5b410884ad320a9cfac8866006a109aa  #v4.8.0
         with:
           python-version: 3.12
           architecture: x64
@@ -48,7 +48,7 @@ jobs:
           mv Cargo.lock Cargo.lock.orig
           sed "s/0\\.0\\.0/${RELEASE_TAG//v}/" Cargo.lock.orig >Cargo.lock
 
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2024-07-18
           override: true
@@ -56,13 +56,13 @@ jobs:
 
       - name: Build wheels
         if: matrix.target == 'universal2-apple-darwin'
-        uses: PyO3/maturin-action@v1
+        uses: PyO3/maturin-action@5f8a1b3b0aad13193f46c9131f9b9e663def8ce5  #v1.46.0
         with:
           target: ${{ matrix.target }}
           args: --release --out dist --features python-bindings
       - name: Build wheels
         if: matrix.target == 'x86_64'
-        uses: PyO3/maturin-action@v1
+        uses: PyO3/maturin-action@5f8a1b3b0aad13193f46c9131f9b9e663def8ce5  #v1.46.0
         with:
           target: ${{ matrix.target }}
           args: --release --out dist --features python-bindings
@@ -73,7 +73,7 @@ jobs:
           python -c "import ezkl"
 
       - name: Upload wheels
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08  #v4.6.0
         with:
           name: dist-macos-${{ matrix.target }}
           path: dist
@@ -87,10 +87,10 @@ jobs:
       matrix:
         target: [x64, x86]
     steps:
-      - uses: actions/checkout@v4
-        with: 
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
+        with:
           persist-credentials: false
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@b64ffcaf5b410884ad320a9cfac8866006a109aa  #v4.8.0
         with:
           python-version: 3.12
           architecture: ${{ matrix.target }}
@@ -113,14 +113,14 @@ jobs:
           mv Cargo.lock Cargo.lock.orig
           sed "s/0\\.0\\.0/${RELEASE_TAG//v}/" Cargo.lock.orig >Cargo.lock
 
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2024-07-18
           override: true
           components: rustfmt, clippy
 
       - name: Build wheels
-        uses: PyO3/maturin-action@v1
+        uses: PyO3/maturin-action@5f8a1b3b0aad13193f46c9131f9b9e663def8ce5  #v1.46.0
         with:
           target: ${{ matrix.target }}
           args: --release --out dist --features python-bindings
@@ -130,7 +130,7 @@ jobs:
           python -c "import ezkl"
 
       - name: Upload wheels
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08  #v4.6.0 #v4.6.0
         with:
           name: dist-windows-${{ matrix.target }}
           path: dist
@@ -144,10 +144,10 @@ jobs:
       matrix:
         target: [x86_64]
     steps:
-      - uses: actions/checkout@v4
-        with: 
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
+        with:
           persist-credentials: false
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@b64ffcaf5b410884ad320a9cfac8866006a109aa  #v4.8.0
         with:
           python-version: 3.12
           architecture: x64
@@ -176,7 +176,7 @@ jobs:
           sudo apt-get update && sudo apt-get install -y openssl pkg-config libssl-dev
 
       - name: Build wheels
-        uses: PyO3/maturin-action@v1
+        uses: PyO3/maturin-action@5f8a1b3b0aad13193f46c9131f9b9e663def8ce5  #v1.46.0
         with:
           target: ${{ matrix.target }}
           manylinux: auto
@@ -203,7 +203,7 @@ jobs:
           python -c "import ezkl"
 
       - name: Upload wheels
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08  #v4.6.0
         with:
           name: dist-linux-${{ matrix.target }}
           path: dist
@@ -218,10 +218,10 @@ jobs:
         target:
           - x86_64-unknown-linux-musl
     steps:
-      - uses: actions/checkout@v4
-        with: 
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
+        with:
           persist-credentials: false
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@b64ffcaf5b410884ad320a9cfac8866006a109aa  #v4.8.0
         with:
           python-version: 3.12
           architecture: x64
@@ -250,7 +250,7 @@ jobs:
           sudo apt-get update && sudo apt-get install -y pkg-config libssl-dev
 
       - name: Build wheels
-        uses: PyO3/maturin-action@v1
+        uses: PyO3/maturin-action@5f8a1b3b0aad13193f46c9131f9b9e663def8ce5  #v1.46.0
         with:
           target: ${{ matrix.target }}
           manylinux: musllinux_1_2
@@ -271,7 +271,7 @@ jobs:
             python3 -c "import ezkl"
 
       - name: Upload wheels
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08  #v4.6.0
         with:
           name: dist-musllinux-${{ matrix.target }}
           path: dist
@@ -287,10 +287,10 @@ jobs:
           - target: aarch64-unknown-linux-musl
             arch: aarch64
     steps:
-      - uses: actions/checkout@v4
-        with: 
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
+        with:
           persist-credentials: false
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@b64ffcaf5b410884ad320a9cfac8866006a109aa  #v4.8.0
         with:
           python-version: 3.12
 
@@ -313,13 +313,13 @@ jobs:
           sed "s/0\\.0\\.0/${RELEASE_TAG//v}/" Cargo.lock.orig >Cargo.lock
 
       - name: Build wheels
-        uses: PyO3/maturin-action@v1
+        uses: PyO3/maturin-action@5f8a1b3b0aad13193f46c9131f9b9e663def8ce5  #v1.46.0
         with:
           target: ${{ matrix.platform.target }}
           manylinux: musllinux_1_2
           args: --release --out dist --features python-bindings
 
-      - uses: uraimo/run-on-arch-action@v2.8.1
+      - uses: uraimo/run-on-arch-action@5397f9e30a9b62422f302092631c99ae1effcd9e  #v2.8.1
         name: Install built wheel
         with:
           arch: ${{ matrix.platform.arch }}
@@ -334,7 +334,7 @@ jobs:
             python3 -c "import ezkl"
 
       - name: Upload wheels
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08  #v4.6.0
         with:
           name: dist-musllinux-${{ matrix.platform.target }}
           path: dist
@@ -347,24 +347,24 @@ jobs:
     if: "startsWith(github.ref, 'refs/tags/')"
     needs: [macos, windows, linux, musllinux, musllinux-cross]
     steps:
-      - uses: actions/download-artifact@v4
+      - uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16  #v4.1.8
         with:
           pattern: dist-*
           merge-multiple: true
           path: wheels
       - name: List Files
         run: ls -R
-      
+
       # # publishes to TestPyPI
       # - name: Publish package distribution to TestPyPI
-      #   uses: pypa/gh-action-pypi-publish@unstable/v1
+      #   uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc  #v1.12.4
       #   with:
       #     repository-url: https://test.pypi.org/legacy/
       #     packages-dir: ./
 
       # publishes to PyPI
       - name: Publish package distributions to PyPI
-        uses: pypa/gh-action-pypi-publish@unstable/v1
+        uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc  #v1.12.4
         with:
           packages-dir: ./wheels
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 999e31406..5002b313f 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -30,7 +30,7 @@ jobs:
 
       - name: Create Github Release
         id: create-release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda  #v2.2.1
         with:
           token: ${{ secrets.RELEASE_TOKEN }}
           tag_name: ${{ env.EZKL_VERSION }}
@@ -49,14 +49,14 @@ jobs:
       RUST_BACKTRACE: 1
       PCRE2_SYS_STATIC: 1
     steps:
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2024-07-18
           override: true
           components: rustfmt, clippy
       - name: Checkout repo
-        uses: actions/checkout@v4
-        with: 
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
+        with:
           persist-credentials: false
 
 
@@ -90,7 +90,7 @@ jobs:
           echo "ASSET=build-artifacts/ezkl-linux-gpu.tar.gz" >> $GITHUB_ENV
 
       - name: Upload release archive
-        uses: actions/upload-release-asset@v1.0.2
+        uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5  #v1.0.2
         env:
           GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
         with:
@@ -144,8 +144,8 @@ jobs:
 
     steps:
       - name: Checkout repo
-        uses: actions/checkout@v4
-        with: 
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
+        with:
           persist-credentials: false
 
       - name: Get release version from tag
@@ -170,7 +170,7 @@ jobs:
           fi
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@nightly
+        uses: dtolnay/rust-toolchain@4f94fbe7e03939b0e674bcc9ca609a16088f63ff  #nightly branch, TODO: update when required
         with:
           target: ${{ matrix.target }}
 
@@ -196,7 +196,7 @@ jobs:
           echo "target flag is: ${{ env.TARGET_FLAGS }}"
           echo "target dir is: ${{ env.TARGET_DIR }}"
 
-      - name: Build release binary (no asm or metal) 
+      - name: Build release binary (no asm or metal)
         if: matrix.build != 'linux-gnu' && matrix.build != 'macos-aarch64'
         run: ${{ env.CARGO }} build --release ${{ env.TARGET_FLAGS }} -Z sparse-registry
 
@@ -233,7 +233,7 @@ jobs:
           echo "ASSET=build-artifacts/ezkl-win.zip" >> $GITHUB_ENV
 
       - name: Upload release archive
-        uses: actions/upload-release-asset@v1.0.2
+        uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5  #v1.0.2
         env:
           GITHUB_TOKEN: ${{ secrets.RELEASE_TOKEN }}
         with:
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index b4692764e..a237ca4a3 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -25,10 +25,10 @@ jobs:
       contents: read
     runs-on: large-self-hosted
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2024-07-18
           override: true
@@ -45,10 +45,10 @@ jobs:
       contents: read
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2024-07-18
           override: true
@@ -61,10 +61,10 @@ jobs:
       contents: read
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2024-07-18
           override: true
@@ -77,15 +77,15 @@ jobs:
       contents: read
     runs-on: ubuntu-latest-32-cores
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2024-07-18
           override: true
           components: rustfmt, clippy
-      - uses: baptiste0928/cargo-install@v1
+      - uses: baptiste0928/cargo-install@91c5da15570085bcde6f4d7aed98cb82d6769fd3  #v3.3.0
         with:
           crate: cargo-nextest
           locked: true
@@ -102,19 +102,19 @@ jobs:
   #   env:
   #     ENABLE_ICICLE_GPU: true
   #   steps:
-  #     - uses: actions/checkout@v4
+  #     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
   # with:
   #   persist-credentials: false
-  #     - uses: actions-rs/toolchain@v1
+  #     - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
   #       with:
   #         toolchain: nightly-2024-07-18
   #         override: true
   #         components: rustfmt, clippy
-  #     - uses: baptiste0928/cargo-install@v1
+  #     - uses: baptiste0928/cargo-install@91c5da15570085bcde6f4d7aed98cb82d6769fd3  #v3.3.0
   #       with:
   #         crate: cargo-nextest
   #         locked: true
-  #     - uses: mwilliamson/setup-wasmtime-action@v2
+  #     - uses: mwilliamson/setup-wasmtime-action@bf814d7d8fc3c3a77dfe114bd9fb8a2c575f6ad6  #v2.0.0
   #       with:
   #         wasmtime-version: "3.0.1"
   #     - name: Install wasm32-wasi
@@ -139,19 +139,19 @@ jobs:
       contents: read
     runs-on: non-gpu
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2024-07-18
           override: true
           components: rustfmt, clippy
-      - uses: baptiste0928/cargo-install@v1
+      - uses: baptiste0928/cargo-install@91c5da15570085bcde6f4d7aed98cb82d6769fd3  #v3.3.0
         with:
           crate: cargo-nextest
           locked: true
-      - uses: mwilliamson/setup-wasmtime-action@v2
+      - uses: mwilliamson/setup-wasmtime-action@bf814d7d8fc3c3a77dfe114bd9fb8a2c575f6ad6  #v2.0.0
         with:
           wasmtime-version: "3.0.1"
       - name: Install wasm32-wasi
@@ -176,19 +176,19 @@ jobs:
       contents: read
     runs-on: non-gpu
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2024-07-18
           override: true
           components: rustfmt, clippy
-      - uses: baptiste0928/cargo-install@v1
+      - uses: baptiste0928/cargo-install@91c5da15570085bcde6f4d7aed98cb82d6769fd3  #v3.3.0
         with:
           crate: cargo-nextest
           locked: true
-      - uses: mwilliamson/setup-wasmtime-action@v2
+      - uses: mwilliamson/setup-wasmtime-action@bf814d7d8fc3c3a77dfe114bd9fb8a2c575f6ad6  #v2.0.0
         with:
           wasmtime-version: "3.0.1"
       - name: Install wasm32-wasi
@@ -213,15 +213,15 @@ jobs:
       contents: read
     runs-on: ubuntu-latest-16-cores
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2024-07-18
           override: true
           components: rustfmt, clippy
-      - uses: baptiste0928/cargo-install@v1
+      - uses: baptiste0928/cargo-install@91c5da15570085bcde6f4d7aed98cb82d6769fd3  #v3.3.0
         with:
           crate: cargo-nextest
           locked: true
@@ -233,19 +233,19 @@ jobs:
       contents: read
     runs-on: non-gpu
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2024-07-18
           override: true
           components: rustfmt, clippy
-      - uses: jetli/wasm-pack-action@v0.4.0
+      - uses: jetli/wasm-pack-action@0d096b08b4e5a7de8c28de67e11e945404e9eefa  #v0.4.0
         with:
           # Pin to version 0.12.1
           version: "v0.12.1"
-      - uses: nanasess/setup-chromedriver@v2
+      - uses: nanasess/setup-chromedriver@e93e57b843c0c92788f22483f1a31af8ee48db25  #v2.3.0
         # with:
         #   chromedriver-version: "115.0.5790.102"
       - name: Install wasm32-unknown-unknown
@@ -262,15 +262,15 @@ jobs:
       contents: read
     runs-on: non-gpu
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2024-07-18
           override: true
           components: rustfmt, clippy
-      - uses: baptiste0928/cargo-install@v1
+      - uses: baptiste0928/cargo-install@91c5da15570085bcde6f4d7aed98cb82d6769fd3  #v3.3.0
         with:
           crate: cargo-nextest
           locked: true
@@ -329,27 +329,27 @@ jobs:
     runs-on: non-gpu
     needs: [build, library-tests, docs, python-tests, python-integration-tests]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2024-07-18
           override: true
           components: rustfmt, clippy
-      - uses: baptiste0928/cargo-install@v1
+      - uses: baptiste0928/cargo-install@91c5da15570085bcde6f4d7aed98cb82d6769fd3  #v3.3.0
         with:
           crate: cargo-nextest
           locked: true
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
       - name: Use pnpm 8
-        uses: pnpm/action-setup@v2
+        uses: pnpm/action-setup@eae0cfeb286e66ffb5155f1a79b90583a127a68b  #v2.4.1
         with:
           version: 8
       - name: Use Node.js 18.12.1
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7  #v3.8.2
         with:
           node-version: "18.12.1"
           cache: "pnpm"
@@ -414,28 +414,28 @@ jobs:
   #   runs-on: macos-13
   #   # needs: [build, library-tests, docs]
   #   steps:
-  #     - uses: actions/checkout@v4
+  #     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
   #       with:
   #         persist-credentials: false
-  #     - uses: actions-rs/toolchain@v1
+  #     - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
   #       with:
   #         toolchain: nightly-2024-07-18
   #         override: true
   #         components: rustfmt, clippy
-  #     - uses: jetli/wasm-pack-action@v0.4.0
+  #     - uses: jetli/wasm-pack-action@0d096b08b4e5a7de8c28de67e11e945404e9eefa  #v0.4.0
   #       with:
   #         # Pin to version 0.12.1
   #         version: 'v0.12.1'
   #     - name: Add rust-src
   #       run: rustup component add rust-src --toolchain nightly-2024-07-18
-  #     - uses: actions/checkout@v3
+  #     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
   #       with:
   #         persist-credentials: false
   #     - name: Use pnpm 8
-  #       uses: pnpm/action-setup@v2
+  #       uses: pnpm/action-setup@eae0cfeb286e66ffb5155f1a79b90583a127a68b  #v2.4.1
   #       with:
   #         version: 8
-  #     - uses: baptiste0928/cargo-install@v1
+  #     - uses: baptiste0928/cargo-install@91c5da15570085bcde6f4d7aed98cb82d6769fd3  #v3.3.0
   #       with:
   #         crate: cargo-nextest
   #         locked: true
@@ -448,15 +448,15 @@ jobs:
     runs-on: non-gpu
     needs: [build, library-tests, docs]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2024-07-18
           override: true
           components: rustfmt, clippy
-      - uses: jetli/wasm-pack-action@v0.4.0
+      - uses: jetli/wasm-pack-action@0d096b08b4e5a7de8c28de67e11e945404e9eefa  #v0.4.0
         with:
           # Pin to version 0.12.1
           version: "v0.12.1"
@@ -465,15 +465,15 @@ jobs:
 
       - name: Add rust-src
         run: rustup component add rust-src --toolchain nightly-2024-07-18-x86_64-unknown-linux-gnu
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
       - name: Use pnpm 8
-        uses: pnpm/action-setup@v2
+        uses: pnpm/action-setup@eae0cfeb286e66ffb5155f1a79b90583a127a68b  #v2.4.1
         with:
           version: 8
       - name: Use Node.js 18.12.1
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@1a4442cacd436585916779262731d5b162bc6ec7  #v3.8.2
         with:
           node-version: "18.12.1"
           cache: "pnpm"
@@ -483,7 +483,7 @@ jobs:
         env:
           CI: false
           NODE_ENV: development
-      - uses: baptiste0928/cargo-install@v1
+      - uses: baptiste0928/cargo-install@91c5da15570085bcde6f4d7aed98cb82d6769fd3  #v3.3.0
         with:
           crate: cargo-nextest
           locked: true
@@ -529,18 +529,18 @@ jobs:
   #   env:
   #     ENABLE_ICICLE_GPU: true
   #   steps:
-  #     - uses: actions/checkout@v4
+  #     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
   # with:
   #   persist-credentials: false
-  #     - uses: actions-rs/toolchain@v1
+  #     - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
   #       with:
   #         toolchain: nightly-2024-07-18
   #         override: true
   #         components: rustfmt, clippy
   #     - name: Add rust-src
   #       run: rustup component add rust-src --toolchain nightly-2024-07-18-x86_64-unknown-linux-gnu
-  #     - uses: actions/checkout@v3
-  #     - uses: baptiste0928/cargo-install@v1
+  #     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
+  #     - uses: baptiste0928/cargo-install@91c5da15570085bcde6f4d7aed98cb82d6769fd3  #v3.3.0
   #       with:
   #         crate: cargo-nextest
   #         locked: true
@@ -567,15 +567,15 @@ jobs:
     runs-on: self-hosted
     needs: [build, library-tests, docs, python-tests, python-integration-tests]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
-      - uses: actions-rs/toolchain@v1
+      - uses: dtolnay/rust-toolchain@4f94fbe7e03939b0e674bcc9ca609a16088f63ff  #nightly branch, TODO: update when required
         with:
           toolchain: nightly-2024-07-18
           override: true
           components: rustfmt, clippy
-      - uses: baptiste0928/cargo-install@v1
+      - uses: baptiste0928/cargo-install@91c5da15570085bcde6f4d7aed98cb82d6769fd3  #v3.3.0
         with:
           crate: cargo-nextest
           locked: true
@@ -587,15 +587,15 @@ jobs:
   #   env:
   #     ENABLE_ICICLE_GPU: true
   #   steps:
-  #     - uses: actions/checkout@v4
+  #     - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
   # with:
   #   persist-credentials: false
-  #     - uses: actions-rs/toolchain@v1
+  #     - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
   #       with:
   #         toolchain: nightly-2024-07-18
   #         override: true
   #         components: rustfmt, clippy
-  #     - uses: baptiste0928/cargo-install@v1
+  #     - uses: baptiste0928/cargo-install@91c5da15570085bcde6f4d7aed98cb82d6769fd3  #v3.3.0
   #       with:
   #         crate: cargo-nextest
   #         locked: true
@@ -608,15 +608,15 @@ jobs:
     runs-on: large-self-hosted
     needs: [build, library-tests, docs, python-tests, python-integration-tests]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2024-07-18
           override: true
           components: rustfmt, clippy
-      - uses: baptiste0928/cargo-install@v1
+      - uses: baptiste0928/cargo-install@91c5da15570085bcde6f4d7aed98cb82d6769fd3  #v3.3.0
         with:
           crate: cargo-nextest
           locked: true
@@ -629,15 +629,15 @@ jobs:
     runs-on: large-self-hosted
     needs: [build, library-tests, docs, python-tests, python-integration-tests]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2024-07-18
           override: true
           components: rustfmt, clippy
-      - uses: baptiste0928/cargo-install@v1
+      - uses: baptiste0928/cargo-install@91c5da15570085bcde6f4d7aed98cb82d6769fd3  #v3.3.0
         with:
           crate: cargo-nextest
           locked: true
@@ -654,15 +654,15 @@ jobs:
     runs-on: ubuntu-latest-32-cores
     needs: [build, library-tests, docs]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2024-07-18
           override: true
           components: rustfmt, clippy
-      - uses: baptiste0928/cargo-install@v1
+      - uses: baptiste0928/cargo-install@91c5da15570085bcde6f4d7aed98cb82d6769fd3  #v3.3.0
         with:
           crate: cargo-nextest
           locked: true
@@ -675,13 +675,13 @@ jobs:
     runs-on: non-gpu
     needs: [build, library-tests, docs]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@b64ffcaf5b410884ad320a9cfac8866006a109aa  #v4.8.0
         with:
           python-version: "3.12"
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2024-07-18
           override: true
@@ -705,18 +705,18 @@ jobs:
     runs-on: non-gpu
     needs: [build, library-tests, docs, python-tests, python-integration-tests]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@b64ffcaf5b410884ad320a9cfac8866006a109aa  #v4.8.0
         with:
           python-version: "3.12"
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2024-07-18
           override: true
           components: rustfmt, clippy
-      - uses: baptiste0928/cargo-install@v1
+      - uses: baptiste0928/cargo-install@91c5da15570085bcde6f4d7aed98cb82d6769fd3  #v3.3.0
         with:
           crate: cargo-nextest
           locked: true
@@ -756,18 +756,18 @@ jobs:
           # Maps tcp port 5432 on service container to the host
           - 5432:5432
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
-      - uses: actions/setup-python@v4
+      - uses: actions/setup-python@b64ffcaf5b410884ad320a9cfac8866006a109aa  #v4.8.0
         with:
           python-version: "3.11"
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2024-07-18
           override: true
           components: rustfmt, clippy
-      - uses: baptiste0928/cargo-install@v1
+      - uses: baptiste0928/cargo-install@91c5da15570085bcde6f4d7aed98cb82d6769fd3  #v3.3.0
         with:
           crate: cargo-nextest
           locked: true
@@ -812,15 +812,15 @@ jobs:
       contents: read
     runs-on: macos-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2024-07-18
           override: true
           components: rustfmt, clippy
-      - uses: baptiste0928/cargo-install@v1
+      - uses: baptiste0928/cargo-install@91c5da15570085bcde6f4d7aed98cb82d6769fd3  #v3.3.0
         with:
           crate: cargo-nextest
           locked: true
@@ -834,10 +834,10 @@ jobs:
     needs: [ios-integration-tests]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2024-07-18
           override: true
diff --git a/.github/workflows/static-analysis.yml b/.github/workflows/static-analysis.yml
index 822ad4d4e..45fef5f3b 100644
--- a/.github/workflows/static-analysis.yml
+++ b/.github/workflows/static-analysis.yml
@@ -12,10 +12,10 @@ jobs:
       contents: read
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
-      - uses: actions-rs/toolchain@v1
+      - uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly-2024-07-18
           override: true
@@ -30,4 +30,3 @@ jobs:
         run: zizmor .
 
 
-    
\ No newline at end of file
diff --git a/.github/workflows/swift-pm.yml b/.github/workflows/swift-pm.yml
index 079444801..02e7281b8 100644
--- a/.github/workflows/swift-pm.yml
+++ b/.github/workflows/swift-pm.yml
@@ -19,8 +19,8 @@ jobs:
 
     steps:
       - name: Checkout EZKL
-        uses: actions/checkout@v3
-        with: 
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
+        with:
           persist-credentials: false
 
       - name: Extract TAG from github.ref_name
@@ -34,7 +34,7 @@ jobs:
           echo "TAG=$NEW_TAG" >> $GITHUB_ENV
 
       - name: Install Rust (nightly)
-        uses: actions-rs/toolchain@v1
+        uses: actions-rs/toolchain@b2417cde72dcf67f306c0ae8e0828a81bf0b189f  #v1.0.6
         with:
           toolchain: nightly
           override: true
diff --git a/.github/workflows/tagging.yml b/.github/workflows/tagging.yml
index 2669f1aab..7ad5f4f4b 100644
--- a/.github/workflows/tagging.yml
+++ b/.github/workflows/tagging.yml
@@ -11,12 +11,12 @@ jobs:
       contents: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  #v4.2.2
         with:
           persist-credentials: false
       - name: Bump version and push tag
         id: tag_version
-        uses: mathieudutour/github-tag-action@v6.2
+        uses: mathieudutour/github-tag-action@a22cf08638b34d5badda920f9daf6e72c477b07b  #v6.2
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
 
@@ -46,7 +46,7 @@ jobs:
           git tag $RELEASE_TAG
 
       - name: Push changes
-        uses: ad-m/github-push-action@master
+        uses: ad-m/github-push-action@77c5b412c50b723d2a4fbc6d71fb5723bcd439aa  #master
         env:
           RELEASE_TAG: ${{ steps.tag_version.outputs.new_tag }}
         with:
diff --git a/Cargo.lock b/Cargo.lock
index e84e01246..49b12f4df 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1932,7 +1932,7 @@ dependencies = [
 ]
 
 [[package]]
-name = "ezkl"
+name = "ezkl-gpu"
 version = "0.0.0"
 dependencies = [
  "alloy",