diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 404cac62e..3085bde24 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -15,8 +15,11 @@ updates:
     # Check for updates once a month
     schedule:
       interval: "monthly"
+    # A new version is not considered for a version update until x days after its release (default = 3)
+    cooldown:
+      default-days: 3
     # Limit the amout of open PR's (default = 5, disabled = 0, security updates are not impacted)
-    open-pull-requests-limit: 2
+    open-pull-requests-limit: 3
 
  # # Enable version updates for Docker
  # Not yet possible to bump from one LTS version to the next and skip others, see:
@@ -27,6 +30,9 @@ updates:
  #   # Check for updates once a week
  #   schedule:
  #     interval: "weekly"
+ #   # A new version is not considered for a version update until x days after its release (default = 3)
+ #   cooldown:
+ #     default-days: 3
  #   # Limit the amout of open PR's (default = 5, disabled = 0, security updates are not impacted)
  #   open-pull-requests-limit: 1
 
@@ -37,5 +43,8 @@ updates:
     # Check for updates to GitHub Actions once a week
     schedule:
       interval: "weekly"
+    # A new version is not considered for a version update until x days after its release (default = 3)
+    cooldown:
+      default-days: 3
     # Limit the amout of open PR's (default = 5, disabled = 0, security updates are not impacted)
-    open-pull-requests-limit: 2
+    open-pull-requests-limit: 5
diff --git a/.github/workflows/desktop-build.yml b/.github/workflows/desktop-build.yml
index 54068f5a0..4ebcb6174 100644
--- a/.github/workflows/desktop-build.yml
+++ b/.github/workflows/desktop-build.yml
@@ -41,8 +41,9 @@ concurrency:
 
 jobs:
   configure:
-    name: Configure
+    name: "Configure"
     runs-on: ubuntu-slim    # https://github.com/actions/runner-images/blob/main/images/ubuntu-slim/ubuntu-slim-Readme.md
+
     outputs:
       tag: ${{ steps.configure.outputs.tag }}
       sha: ${{ steps.configure.outputs.sha }}
@@ -54,10 +55,10 @@ jobs:
 
     steps:
       - name: "Configure"
-        env:
-          RESOLVED_SHA: ${{ case(github.event_name == 'pull_request', github.event.pull_request.head.sha, github.sha) }}
         id: configure
         shell: bash
+        env:
+          RESOLVED_SHA: ${{ case(github.event_name == 'pull_request', github.event.pull_request.head.sha, github.sha) }}
         run: |
           if [[ "$GITHUB_REF_TYPE" == 'tag' ]]; then    # release
             echo "tag=$GITHUB_REF_NAME" >> "$GITHUB_OUTPUT"
@@ -69,7 +70,7 @@ jobs:
 
       - name: "Checkout"
         if: steps.configure.outputs.tag != null
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0    # fetch all history for all branches and tags
 
@@ -102,6 +103,10 @@ jobs:
             --notes-file "$body_path"
 
   build-linux:
+    name: "${{ matrix.distro }} ${{ matrix.version }}${{ matrix.variant && format(' {0}', matrix.variant) || '' }}"
+    needs: configure
+    runs-on: ubuntu-latest    # https://github.com/actions/runner-images#available-images
+
     strategy:
       fail-fast: false
       matrix:
@@ -110,7 +115,7 @@ jobs:
           - distro: Arch
 
             allow-failure: yes
-            package: skip    # We are packaged in Arch already
+            package: skip    # we are packaged in Arch already
 
           - distro: Servatrice_Debian
             version: 12
@@ -123,7 +128,7 @@ jobs:
             version: 12
 
             package: DEB
-            test: skip    # Running tests on all distros is superfluous
+            test: skip    # running tests on all distros is superfluous
 
           - distro: Debian
             version: 13
@@ -134,7 +139,7 @@ jobs:
             version: 43
 
             package: RPM
-            test: skip    # Running tests on all distros is superfluous
+            test: skip    # running tests on all distros is superfluous
 
           - distro: Fedora
             version: 44
@@ -145,7 +150,7 @@ jobs:
             version: 24.04
 
             package: DEB
-            test: skip    # Running tests on all distros is superfluous
+            test: skip    # running tests on all distros is superfluous
 
           - distro: Ubuntu
             version: 26.04
@@ -170,26 +175,23 @@ jobs:
             coverage: yes
             package: skip
 
-    name: ${{ matrix.distro }} ${{ matrix.version }}${{ matrix.variant && format(' {0}', matrix.variant) || '' }}
-    needs: configure
-    runs-on: ubuntu-latest    # https://github.com/actions/runner-images
     continue-on-error: ${{ matrix.allow-failure == 'yes' }}
     timeout-minutes: 70
     env:
       CACHE: ${{ github.workspace }}/.cache/${{ matrix.distro }}${{ matrix.version }}${{ matrix.variant }}    # directory for caching docker image and ccache
       CCACHE_EVICTION_AGE: 7d
       CCACHE_SIZE: 600M    # space of all repo is 10Gi: https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#usage-limits-and-eviction-policy
-      CMAKE_GENERATOR: 'Ninja'
+      CMAKE_GENERATOR: Ninja
       NAME: ${{ matrix.distro }}${{ matrix.version }}
       IMAGE_SUFFIX: ${{ matrix.variant }}
 
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: "Restore compiler cache (ccache)"
         id: restore_ccache
-        uses: actions/cache/restore@v6
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           key: ccache-${{ matrix.distro }}${{ matrix.version }}${{ matrix.variant }}
           path: ${{ env.CACHE }}/.ccache
@@ -217,8 +219,8 @@ jobs:
 
           RUN --server --debug --test "${extra[@]}" "${args[@]}"
 
-      # RUN bind-mounts the workspace into the container, so the report the build wrote into
-      # build/ is already on the host and no second container is needed to collect it.
+      # RUN bind-mounts the workspace into the container, so the report the build wrote
+      # into build/ is already on the host and no second container is needed to collect it.
       - name: "Collect coverage report"
         if: matrix.coverage == 'yes'
         shell: bash
@@ -233,7 +235,7 @@ jobs:
 
       - name: "Upload coverage artifact"
         if: matrix.coverage == 'yes'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           name: coverage-report
           path: coverage/
@@ -327,7 +329,7 @@ jobs:
 
       - name: "Save updated compiler cache (ccache)"
         if: github.ref == 'refs/heads/master'
-        uses: actions/cache/save@v6
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           key: ${{ steps.restore_ccache.outputs.cache-primary-key }}
           path: ${{ env.CACHE }}/.ccache
@@ -335,7 +337,7 @@ jobs:
       - name: "Upload artifact"
         id: upload_artifact
         if: matrix.package != 'skip'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           archive: false
           if-no-files-found: error
@@ -355,7 +357,7 @@ jobs:
       - name: "Attest binary provenance"
         id: attestation
         if: steps.upload_release.outcome == 'success'
-        uses: actions/attest@v4
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           show-summary: false
           subject-path: ${{ steps.build.outputs.path }}
@@ -369,6 +371,10 @@ jobs:
         run: gh attestation verify "$BUILD_PATH" --repo Cockatrice/Cockatrice
 
   build-vcpkg:
+    name: "${{ matrix.os }} ${{ matrix.target }}${{ matrix.soc == 'Intel' && ' Intel' || '' }}${{ matrix.type == 'Debug' && ' Debug' || '' }}"
+    needs: configure
+    runs-on: ${{ matrix.runner }}
+
     strategy:
       fail-fast: false
       matrix:
@@ -465,9 +471,6 @@ jobs:
             vcpkg_scope: 'vcpkg/windows10-x64-vs2026/'
             vcpkg_upload: 1    # only one leg per vcpkg_scope hands its archives over
 
-    name: ${{ matrix.os }} ${{ matrix.target }}${{ matrix.soc == 'Intel' && ' Intel' || '' }}${{ matrix.type == 'Debug' && ' Debug' || '' }}
-    needs: configure
-    runs-on: ${{ matrix.runner }}
     timeout-minutes: 100
     env:
       CCACHE_DIR: ${{ github.workspace }}/.cache/
@@ -475,24 +478,24 @@ jobs:
 
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           submodules: recursive
 
       - name: "[Windows] Add msbuild to PATH"
         if: matrix.os == 'Windows'
-        uses: microsoft/setup-msbuild@v3
+        uses: microsoft/setup-msbuild@30375c66a4eea26614e0d39710365f22f8b0af57 # v3.0.0
         with:
           msbuild-architecture: x64
 
-      - name: "[macOS] Setup ccache"
+      - name: "[macOS] Install ccache"
         if: matrix.os == 'macOS' && matrix.use_ccache == 1
         run: brew install ccache
 
       - name: "[macOS] Restore compiler cache (ccache)"
         if: matrix.os == 'macOS' && matrix.use_ccache == 1
         id: restore_ccache
-        uses: actions/cache/restore@v6
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           key: ccache-${{ matrix.runner }}_${{ matrix.override_target }}-Xcode${{ matrix.xcode }}
           path: ${{ env.CCACHE_DIR }}
@@ -513,7 +516,7 @@ jobs:
       - name: "[macOS] Restore thin Qt ${{ steps.resolve_qt_version.outputs.version }}"
         if: matrix.os == 'macOS'
         id: restore_qt
-        uses: actions/cache/restore@v6
+        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           key: Qt-${{ steps.resolve_qt_version.outputs.version }}-macOS-${{ matrix.soc }}-${{ matrix.qt_modules }}-thin
           path: ${{ github.workspace }}/Qt
@@ -522,7 +525,7 @@ jobs:
       # Qt build using vcpkg either just fails or takes too long to build
       - name: "[macOS] Install fat Qt ${{ matrix.qt_version }}"
         if: matrix.os == 'macOS' && steps.restore_qt.outputs.cache-hit != 'true'
-        uses: jurplel/install-qt-action@v4
+        uses: jurplel/install-qt-action@b344308e4483fc892e0d27b3cd1b173ebdd95f06 # v4.5.0
         with:
           cache: false
           # cache-key-prefix: Qt
@@ -536,14 +539,14 @@ jobs:
 
       - name: "[macOS] Cache thin Qt libraries"
         if: matrix.os == 'macOS' && steps.restore_qt.outputs.cache-hit != 'true' && github.ref == 'refs/heads/master'
-        uses: actions/cache/save@v6
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           key: ${{ steps.restore_qt.outputs.cache-primary-key }}
           path: ${{ github.workspace }}/Qt
 
       - name: "[Windows] Install Qt ${{ matrix.qt_version }}"
         if: matrix.os == 'Windows'
-        uses: jurplel/install-qt-action@v4
+        uses: jurplel/install-qt-action@b344308e4483fc892e0d27b3cd1b173ebdd95f06 # v4.5.0
         with:
           # Qt 6.11.0 only works with aqtinstall directly from git until aqtinstall 3.4 is released
           aqtsource: git+https://github.com/miurahr/aqtinstall.git
@@ -566,7 +569,7 @@ jobs:
 
       - name: "Setup vcpkg cache"
         id: vcpkg-cache
-        uses: TAServers/vcpkg-cache@v3
+        uses: TAServers/vcpkg-cache@4f07be616a4604dd29f3c6885975cf2c04abee71 # v3.4.2
         with:
           # Every entry is keyed by vcpkg ABI hash, and one hash set exists per platform,
           # target and toolchain. The action restores every entry it finds under the
@@ -716,7 +719,7 @@ jobs:
                 if [[ -f ${runtime_path:-} ]]; then
                   paths+=("$runtime_path")
                 else
-                  echo "::warning::shipped Qt runtime $runtime not found under $qt_dir"
+                  echo "::warning::Shipped Qt runtime $runtime not found under $qt_dir"
                 fi
               done < <(grep -E '^(Qt6[^/]*\.dll|Plugins/)' build/required-runtime.txt)
             fi
@@ -812,7 +815,7 @@ jobs:
       - name: "Upload new vcpkg entries"
         # An empty count means the step above did not run at all, on master and on forks
         if: steps.vcpkg_new.outputs.count != '' && steps.vcpkg_new.outputs.count != '0'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           if-no-files-found: error    # a count above zero with nothing staged is a bug
           name: vcpkg-new-${{ steps.vcpkg_new.outputs.slug }}
@@ -833,7 +836,7 @@ jobs:
 
       - name: "[macOS] Cache updated compiler cache (ccache)"
         if: matrix.os == 'macOS' && matrix.use_ccache == 1 && github.ref == 'refs/heads/master'
-        uses: actions/cache/save@v6
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           key: ${{ steps.restore_ccache.outputs.cache-primary-key }}
           path: ${{ env.CCACHE_DIR }}
@@ -888,7 +891,7 @@ jobs:
       - name: "Upload artifact"
         if: matrix.make_package
         id: upload_artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           archive: false
           if-no-files-found: error
@@ -920,7 +923,7 @@ jobs:
       # debug identifier, and the PE is what carries the unwind information.
       - name: "[Windows] Upload debug symbols (exe + pdb)"
         if: matrix.os == 'Windows' && needs.configure.outputs.tag != null
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           if-no-files-found: error
           name: ${{ steps.build.outputs.name }}-Symbols
@@ -935,7 +938,7 @@ jobs:
       - name: "Attest binary provenance"
         if: steps.upload_release.outcome == 'success'
         id: attestation
-        uses: actions/attest@v4
+        uses: actions/attest@1e69f48acb82d1966a394da916b4c1698aa569d6 # v4.2.2
         with:
           show-summary: false
           subject-path: ${{ steps.build.outputs.path }}
@@ -949,10 +952,11 @@ jobs:
         run: gh attestation verify "$BUILD_PATH" --repo Cockatrice/Cockatrice
 
   prune-caches:
-    name: Prune caches
+    name: "Prune caches"
     # Only master writes caches at all, so only master may clean them up too
     if: github.ref == 'refs/heads/master'
     runs-on: ubuntu-slim    # https://github.com/actions/runner-images/blob/main/images/ubuntu-slim/ubuntu-slim-Readme.md
+
     continue-on-error: true    # freeing space must never fail a build
 
     steps:
@@ -987,27 +991,27 @@ jobs:
 
             reason=""
             if [[ $ref != refs/heads/master ]]; then
-              reason="scoped to $ref"
+              reason="Scoped to $ref"
             elif [[ $key == vcpkg/* ]]; then
               # "<scope>/<abi hash>", cut the hash off the end to get the scope
               scope="vcpkg/${key#vcpkg/}"
               scope="${scope%/*}/"
               if [[ $live != *" $scope "* ]]; then
-                reason="no matrix leg uses $scope"
+                reason="No matrix leg uses $scope"
               fi
             fi
             if [[ -z $reason ]]; then
               stamp="$(date -u -d "$accessed" +%s 2>/dev/null || echo 0)"
               if [[ $stamp -ne 0 && $stamp -lt $cutoff ]]; then
-                reason="unused since $accessed"
+                reason="Unused since $accessed"
               fi
             fi
 
             if [[ -n $reason ]]; then
-              echo "::notice::deleting $key, $reason"
+              echo "::notice::Deleting $key, $reason"
               gh api -X DELETE "repos/$GITHUB_REPOSITORY/actions/caches/$id"
               deleted=$((deleted + 1))
             fi
           done <"$RUNNER_TEMP/caches.tsv"
 
-          echo "::notice::deleted $deleted of $(wc -l <"$RUNNER_TEMP/caches.tsv") cache entries"
+          echo "::notice::Deleted $deleted of $(wc -l <"$RUNNER_TEMP/caches.tsv") cache entries"
diff --git a/.github/workflows/desktop-lint.yml b/.github/workflows/desktop-lint.yml
index 93ba79464..6c265143d 100644
--- a/.github/workflows/desktop-lint.yml
+++ b/.github/workflows/desktop-lint.yml
@@ -1,7 +1,7 @@
 name: Code Style (C++) 
 
 permissions:
-  contents: read
+  contents: read    # needed to checkout repo
 
 on:
   # Push trigger not needed for linting, we do not allow direct pushes to master
@@ -21,11 +21,12 @@ on:
 
 jobs:
   format:
-    runs-on: ubuntu-slim
+    name: "Check formatting"
+    runs-on: ubuntu-slim    # https://github.com/actions/runner-images/blob/main/images/ubuntu-slim/ubuntu-slim-Readme.md
 
     steps:
     - name: "Checkout"
-      uses: actions/checkout@v7
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       with:
         fetch-depth: 20    # should be enough to find merge base
 
diff --git a/.github/workflows/docker-release.yml b/.github/workflows/docker-release.yml
index 937386940..eeeec1db4 100644
--- a/.github/workflows/docker-release.yml
+++ b/.github/workflows/docker-release.yml
@@ -56,7 +56,7 @@ jobs:
         include:
           - label: x86
             platform: linux/amd64
-            runner: ubuntu-latest    # https://github.com/actions/runner-images
+            runner: ubuntu-latest    # https://github.com/actions/runner-images#available-images
 
           - label: arm
             platform: linux/arm64
@@ -67,17 +67,17 @@ jobs:
 
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ case(github.event_name == 'workflow_dispatch', format('refs/tags/{0}', inputs.tag), '') }}
 
       - name: "Set up Docker buildx"
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
 
       - name: "Login to GitHub Container Registry (GHCR)"
         if: (github.event_name == 'release' && github.event.release.prerelease == false) || github.event_name == 'workflow_dispatch'
         id: login
-        uses: docker/login-action@v4
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -86,7 +86,7 @@ jobs:
       # Don't push for non-publishing triggers
       - name: "Build image"
         if: steps.login.outcome != 'success'
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           cache-from: type=gha,scope=${{ env.CACHE_SCOPE }}
           cache-to: ${{ case(github.ref == 'refs/heads/master', format('type=gha,mode=max,scope={0}', env.CACHE_SCOPE), '') }}
@@ -98,7 +98,7 @@ jobs:
       - name: "Build image and push by digest"
         if: steps.login.outcome == 'success'
         id: build
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           cache-from: type=gha,scope=${{ env.CACHE_SCOPE }}
           cache-to: type=gha,mode=max,scope=${{ env.CACHE_SCOPE }}
@@ -109,7 +109,7 @@ jobs:
             org.opencontainers.image.url=${{ env.OCI_URL }}
           outputs: type=image,name=${{ env.GHCR_IMAGE }},name-canonical=true,push=true,push-by-digest=true
           platforms: ${{ matrix.platform }}
-          provenance: mode=max    # Do not pass secrets as build arguments with this option
+          provenance: mode=max    # do not pass secrets as build arguments with this option
           sbom: true
 
       - name: "Export digest"
@@ -122,7 +122,7 @@ jobs:
 
       - name: "Upload digest"
         if: steps.login.outcome == 'success'
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
         with:
           if-no-files-found: error
           name: digest-${{ matrix.label }}
@@ -139,14 +139,14 @@ jobs:
 
     steps:
       - name: "Download digests"
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           path: ${{ runner.temp }}/digests
           pattern: digest-*
           merge-multiple: true
 
       - name: "Login to GitHub Container Registry (GHCR)"
-        uses: docker/login-action@v4
+        uses: docker/login-action@81c6f93d4bc991e510b342a00b419b3bb4efc5c6 # v4.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -154,7 +154,7 @@ jobs:
 
       - name: "Docker metadata"
         id: metadata
-        uses: docker/metadata-action@v6
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: ${{ env.GHCR_IMAGE }}
           flavor: |
diff --git a/.github/workflows/documentation-build.yml b/.github/workflows/documentation-build.yml
index 91ee14e3e..79b780385 100644
--- a/.github/workflows/documentation-build.yml
+++ b/.github/workflows/documentation-build.yml
@@ -1,4 +1,4 @@
-name: Generate Docs
+name: Build Documentation
 
 permissions:
   contents: read    # write permission to the destination repo come from 'deploy_key'
@@ -24,12 +24,12 @@ env:
 
 jobs:
   docs:
-    name: Doxygen
-    runs-on: ubuntu-latest
+    name: "Doxygen"
+    runs-on: ubuntu-latest    # https://github.com/actions/runner-images#available-images
 
     steps:
       - name: "Checkout"
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           submodules: recursive
 
@@ -42,7 +42,7 @@ jobs:
       - name: "Install Doxygen"
         uses: ssciwr/doxygen-install@v2
         with:
-          version: "1.18.0"
+          version: "1.18.0"    # https://www.doxygen.nl/manual/changelog.html
 
       - name: "Update Doxygen Configuration"
         shell: bash
@@ -65,7 +65,7 @@ jobs:
 
       - name: "Deploy to cockatrice.github.io/docs"
         if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
-        uses: peaceiris/actions-gh-pages@v4
+        uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4.1.0
         with:
           deploy_key: ${{ secrets.DOCS_DEPLOY_KEY }}
           destination_dir: docs    # docs will be available at https://cockatrice.github.io/docs/
diff --git a/.github/workflows/translations-pull.yml b/.github/workflows/translations-pull.yml
index da3df1714..bf63ea420 100644
--- a/.github/workflows/translations-pull.yml
+++ b/.github/workflows/translations-pull.yml
@@ -16,15 +16,14 @@ on:
 
 jobs:
   translations:
+    name: "Pull languages"
     # Do not run the scheduled workflow on forks
     if: github.event_name != 'schedule' || github.repository_owner == 'Cockatrice'
-
-    name: Pull languages
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-slim    # https://github.com/actions/runner-images/blob/main/images/ubuntu-slim/ubuntu-slim-Readme.md
 
     steps:
       - name: "Checkout repo"
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: "Pull translated strings from Transifex"
         # Do not run this step for PR's from forks, they don't have access to the secret
@@ -39,7 +38,7 @@ jobs:
       - name: "Create pull request"
         if: github.event_name != 'pull_request'
         id: create_pr
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           add-paths: |
             cockatrice/translations/*.ts
diff --git a/.github/workflows/translations-push.yml b/.github/workflows/translations-push.yml
index 17645cab2..fc8f78a13 100644
--- a/.github/workflows/translations-push.yml
+++ b/.github/workflows/translations-push.yml
@@ -16,15 +16,14 @@ on:
 
 jobs:
   translations:
+    name: "Push strings"
     # Do not run the scheduled workflow on forks
     if: github.event_name != 'schedule' || github.repository_owner == 'Cockatrice'
-
-    name: Push strings
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-slim    # https://github.com/actions/runner-images/blob/main/images/ubuntu-slim/ubuntu-slim-Readme.md
 
     steps:
       - name: "Checkout repo"
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: "Install lupdate"
         shell: bash
@@ -37,7 +36,7 @@ jobs:
           FILE: cockatrice/cockatrice_en@source.ts
         id: cockatrice
         shell: bash
-        run: >
+        run: |
           DIRS="cockatrice/src $(find . -maxdepth 1 -type d -name 'libcockatrice_*')"
           .ci/update_translation_source_strings.sh
 
@@ -45,13 +44,13 @@ jobs:
         id: oracle
         shell: bash
         env:
-          DIRS: 'oracle/src'
-          FILE: 'oracle/oracle_en@source.ts'
+          DIRS: oracle/src
+          FILE: oracle/oracle_en@source.ts
         run: .ci/update_translation_source_strings.sh
 
       - name: "Render template"
         id: template
-        uses: chuhlomin/render-template/binary@v1
+        uses: chuhlomin/render-template/binary@a7c644e341797d050d1cb24332d83791b9a46dae # v1.12
         with:
           template: .ci/update_translation_source_strings_template.md
           vars: |
@@ -62,7 +61,7 @@ jobs:
       - name: "Create pull request"
         if: github.event_name != 'pull_request'
         id: create_pr
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           add-paths: |
             cockatrice/cockatrice_en@source.ts
diff --git a/.github/workflows/vcpkg-cache-import.yml b/.github/workflows/vcpkg-cache-import.yml
index 3cc7b2203..58e84640e 100644
--- a/.github/workflows/vcpkg-cache-import.yml
+++ b/.github/workflows/vcpkg-cache-import.yml
@@ -21,8 +21,10 @@ permissions:
 
 on:
   workflow_run:
-    workflows: ["Build Desktop"]
-    types: [completed]
+    workflows:
+      - 'Build Desktop'
+    types:
+      - completed
 
 # Every import writes the same scopes, so let them queue instead of racing each other
 concurrency:
@@ -31,12 +33,12 @@ concurrency:
 
 jobs:
   list:
-    name: List new vcpkg entries
+    name: "List new vcpkg entries"
     # Only a successful push to the default branch has archives worth importing.
     # Only code that landed on master may populate the scope master runs restore.
     # Bot actors are excluded on top: their runs must never promote binaries into
     # the shared scope even if they somehow target the default branch.
-    if: >-
+    if: |
       github.event.workflow_run.conclusion == 'success' &&
       github.event.workflow_run.event == 'push' &&
       github.event.workflow_run.head_branch == 'master' &&
@@ -44,6 +46,7 @@ jobs:
       !endsWith(github.event.workflow_run.actor.login, '[bot]') &&
       !endsWith(github.event.workflow_run.triggering_actor.login, '[bot]')
     runs-on: ubuntu-slim    # https://github.com/actions/runner-images/blob/main/images/ubuntu-slim/ubuntu-slim-Readme.md
+
     # workflow_run is a low-trust trigger, so cache access is read-only by default even
     # though this run resolves to the default branch. Assert below that this took effect,
     # because a save under read-only access only warns and would import nothing silently.
@@ -53,7 +56,7 @@ jobs:
 
     steps:
       - name: "Download new vcpkg entries"
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: vcpkg-new-*
           path: incoming
@@ -64,7 +67,7 @@ jobs:
         shell: bash
         run: |
           if [[ $ACTIONS_CACHE_MODE != *write* ]]; then
-            echo "::error::expected a write-capable cache, got '$ACTIONS_CACHE_MODE'"
+            echo "::error::Expected a write-capable cache, got '$ACTIONS_CACHE_MODE'"
             exit 1
           fi
 
@@ -86,14 +89,16 @@ jobs:
           # Compact, because a multi line value cannot be written to GITHUB_OUTPUT
           entries="$(jq -cs '.' <<<"$entries")"
           echo "entries=$entries" >>"$GITHUB_OUTPUT"
-          echo "::notice::importing $(jq length <<<"$entries") vcpkg entries"
+          echo "::notice::Importing $(jq length <<<"$entries") vcpkg entries"
 
   save:
     name: "Save ${{ matrix.entry.key }}"
-    needs: list
     if: needs.list.outputs.entries
-    runs-on: ubuntu-slim
+    needs: list
+    runs-on: ubuntu-slim    # https://github.com/actions/runner-images/blob/main/images/ubuntu-slim/ubuntu-slim-Readme.md
+
     cache-mode: write
+
     strategy:
       # One job per archive, they run in parallel and each only uploads a single file
       fail-fast: false
@@ -103,7 +108,7 @@ jobs:
 
     steps:
       - name: "Download new vcpkg entries"
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
         with:
           pattern: ${{ matrix.entry.artifact }}
           path: incoming
@@ -111,7 +116,7 @@ jobs:
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: "Save vcpkg entry"
-        uses: actions/cache/save@v6
+        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         with:
           # The payload is a Windows or macOS archive while the upload runs on Linux, and
           # without this the entry would be stamped as a Linux cache that neither of them