14 files changed, 228 insertions, 140 deletions

diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index d095d6d..976f2d3 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -10,7 +10,7 @@ concurrency:
 jobs:
   test:
     name: "Test ${{ matrix.name }}"
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       contents: read
     strategy:
@@ -25,7 +25,7 @@ jobs:
             max-nal: 30
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: "Run CI script"
         run: ./scripts/test
diff --git a/.github/workflows/cifuzz.yml b/.github/workflows/cifuzz.yml
index 966d92a..eaa0681 100644
--- a/.github/workflows/cifuzz.yml
+++ b/.github/workflows/cifuzz.yml
@@ -9,7 +9,7 @@ concurrency:
 
 jobs:
   Fuzzing:
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     steps:
     - name: Build Fuzzers
       id: build
@@ -26,7 +26,7 @@ jobs:
         dry-run: false
         language: c++
     - name: Upload Crash
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
       if: failure() && steps.build.outcome == 'success'
       with:
         name: artifacts
diff --git a/.github/workflows/cmake-config.yml b/.github/workflows/cmake-config.yml
new file mode 100644
index 0000000..0de7b4f
--- /dev/null
+++ b/.github/workflows/cmake-config.yml
@@ -0,0 +1,98 @@
+# GitHub Actions workflow to check CMake config.
+name: "CMake Check"
+
+on:
+  push: {}
+  pull_request: {}
+
+concurrency:
+  group: "${{ github.workflow }}-${{ github.event.number || github.ref }}"
+  cancel-in-progress: true
+
+jobs:
+  check:
+    name: "${{ matrix.os }}"
+    runs-on: "${{ matrix.os }}"
+    strategy:
+      fail-fast: true
+      matrix:
+        os: [ "windows-2022", "macos-14", "ubuntu-24.04" ]
+    defaults:
+      run:
+        shell: "bash"
+    permissions:
+      contents: read
+    steps:
+      - name: "Checkout repository"
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+
+      - name: "Setup Windows dependencies"
+        if: runner.os == 'Windows'
+        uses: msys2/setup-msys2@4f806de0a5a7294ffabaff804b38a9b435a73bda # v2.30.0
+        with:
+          update: true
+          install: >-
+            autoconf
+            automake
+            diffutils
+            libtool
+            gcc
+            git
+            patch
+            perl
+
+      - name: "Setup macOS dependencies"
+        if: runner.os == 'macOS'
+        run: brew install automake libtool
+
+      - name: "Prepare source tree for build (Windows)"
+        if: runner.os == 'Windows'
+        shell: "msys2 {0}"
+        run: ./autogen.sh
+
+      - name: "Prepare source tree for build (Unix)"
+        if: runner.os != 'Windows'
+        run: ./autogen.sh
+
+      - name: "Configure"
+        run: |
+          cmake -S . \
+            -B build \
+            -D CMAKE_BUILD_TYPE=Release \
+            -D CMAKE_INSTALL_PREFIX=$GITHUB_WORKSPACE/../local
+
+      - name: "Build"
+        run: cmake --build build --config Release --verbose
+
+      - name: "Install"
+        run: cmake --install build --config Release
+
+      - name: "Consume from the build directory - Configure"
+        run: |
+          cmake -S tests/cmake \
+            -B consumer-build \
+            -D CMAKE_BUILD_TYPE=Release \
+            -D LibreSSL_DIR=$GITHUB_WORKSPACE/build
+
+      - name: "Consume from the build directory - Build"
+        run: cmake --build consumer-build --config Release --verbose
+
+      - name: "Consume from the install directory (CMAKE_PREFIX_PATH) - Configure"
+        run: |
+          cmake -S tests/cmake \
+            -B consumer-install-prefix \
+            -D CMAKE_BUILD_TYPE=Release \
+            -D CMAKE_PREFIX_PATH=$GITHUB_WORKSPACE/../local
+
+      - name: "Consume from the install directory (CMAKE_PREFIX_PATH) - Build"
+        run: cmake --build consumer-install-prefix --config Release --verbose
+
+      - name: "Consume from the install directory (LibreSSL_DIR) - Configure"
+        run: |
+          cmake -S tests/cmake \
+            -B consumer-install-dir \
+            -D CMAKE_BUILD_TYPE=Release \
+            -D LibreSSL_DIR=$GITHUB_WORKSPACE/../local/lib/cmake/LibreSSL
+
+      - name: "Consume from the install directory (LibreSSL_DIR) - Build"
+        run: cmake --build consumer-install-dir --config Release --verbose
diff --git a/.github/workflows/cmake_config.yml b/.github/workflows/cmake_config.yml
deleted file mode 100644
index be9f114..0000000
--- a/.github/workflows/cmake_config.yml
+++ /dev/null
@@ -1,89 +0,0 @@
-name: cmake_config
-
-on: [push, pull_request]
-
-concurrency:
-  group: "${{ github.workflow }}-${{ github.event.number || github.ref }}"
-  cancel-in-progress: true
-
-jobs:
-  cmake-check:
-    defaults:
-      run:
-        shell: bash
-    strategy:
-      matrix:
-        os: [windows-latest, macos-latest, ubuntu-latest]
-    runs-on: ${{ matrix.os }}
-    continue-on-error: false
-    name: ${{ matrix.os }}
-    steps:
-      - name: Setup Windows dependencies
-        if: runner.os == 'Windows'
-        uses: msys2/setup-msys2@v2
-        with:
-          update: true
-          install: >-
-            autoconf
-            automake
-            diffutils
-            libtool
-            gcc
-            git
-            patch
-            perl
-
-      - name: Setup macOS dependencies
-        if: runner.os == 'macOS'
-        run: brew install automake libtool
-
-      - uses: actions/checkout@main
-
-      - name: Prepare source tree for build (Windows)
-        if: runner.os == 'Windows'
-        run: ./autogen.sh
-        shell: msys2 {0}
-
-      - name: Prepare source tree for build (Unix)
-        if: runner.os != 'Windows'
-        run: ./autogen.sh
-
-      - name: Configure
-        run: |
-          cmake -S . \
-                -B build \
-                -D CMAKE_BUILD_TYPE=Release \
-                -D CMAKE_INSTALL_PREFIX=$GITHUB_WORKSPACE/../local
-
-      - name: Build
-        run: cmake --build build --config Release --verbose
-
-      - name: Install
-        run: cmake --install build --config Release
-
-      - name: Consume from the build directory - Configure
-        run: |
-          cmake -S tests/cmake \
-                -B consumer-build \
-                -D CMAKE_BUILD_TYPE=Release \
-                -D LibreSSL_DIR=$GITHUB_WORKSPACE/build
-      - name: Consume from the build directory - Build
-        run: cmake --build consumer-build --config Release --verbose
-
-      - name: Consume from the install directory (CMAKE_PREFIX_PATH) - Configure
-        run: |
-          cmake -S tests/cmake \
-            -B consumer-install-prefix \
-            -D CMAKE_BUILD_TYPE=Release \
-            -D CMAKE_PREFIX_PATH=$GITHUB_WORKSPACE/../local
-      - name: Consume from the install directory (CMAKE_PREFIX_PATH) - Build
-        run: cmake --build consumer-install-prefix --config Release --verbose
-
-      - name: Consume from the install directory (LibreSSL_DIR) - Configure
-        run: |
-          cmake -S tests/cmake \
-                -B consumer-install-dir \
-                -D CMAKE_BUILD_TYPE=Release \
-                -D LibreSSL_DIR=$GITHUB_WORKSPACE/../local/lib/cmake/LibreSSL
-      - name: Consume from the install directory (LibreSSL_DIR) - Build
-        run: cmake --build consumer-install-dir --config Release --verbose
diff --git a/.github/workflows/coverity.yml b/.github/workflows/coverity.yml
index 112678f..3cc0560 100644
--- a/.github/workflows/coverity.yml
+++ b/.github/workflows/coverity.yml
@@ -13,13 +13,13 @@ concurrency:
 jobs:
   scan:
     name: "Scan"
-    runs-on: "ubuntu-latest"
+    runs-on: "ubuntu-24.04"
     if: github.repository_owner == 'libressl' # Prevent running on forks
     permissions:
       contents: read
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: "Install dependencies"
         run: |
@@ -31,7 +31,7 @@ jobs:
           PROJECT: "libressl-portable%2Fportable"
           COVERITY_SCAN_TOKEN: "${{ secrets.COVERITY_SCAN_TOKEN }}"
         run: |
-          wget -c -N https://scan.coverity.com/download/linux64 --post-data "token=$COVERITY_SCAN_TOKEN&project=$PROJECT" -O coverity_tool.tar.gz
+          wget -nv https://scan.coverity.com/download/linux64 --post-data "token=$COVERITY_SCAN_TOKEN&project=$PROJECT" -O coverity_tool.tar.gz
           mkdir coverity_tool
           tar xzf coverity_tool.tar.gz --strip 1 -C coverity_tool
 
diff --git a/.github/workflows/emscripten.yml b/.github/workflows/emscripten.yml
index 07f140d..2de51e0 100644
--- a/.github/workflows/emscripten.yml
+++ b/.github/workflows/emscripten.yml
@@ -14,16 +14,16 @@ concurrency:
 jobs:
   test:
     name: "Emscripten"
-    runs-on: "ubuntu-latest"
+    runs-on: "ubuntu-24.04"
     if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }}
     permissions:
       contents: read
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: "Setup emsdk"
-        uses: mymindstorm/setup-emsdk@v14
+        uses: mymindstorm/setup-emsdk@6ab9eb1bda2574c4ddb79809fc9247783eaf9021 # v14
         with:
           version: "3.1.60"
 
@@ -42,16 +42,16 @@ jobs:
   # Test ASAN with and without ASM enabled.
   test-asan:
     name: "ASAN (no-asm)"
-    runs-on: "ubuntu-latest"
+    runs-on: "ubuntu-24.04"
     if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }}
     permissions:
       contents: read
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: "Setup emsdk"
-        uses: mymindstorm/setup-emsdk@v14
+        uses: mymindstorm/setup-emsdk@6ab9eb1bda2574c4ddb79809fc9247783eaf9021 # v14
         with:
           version: "3.1.60"
 
diff --git a/.github/workflows/fedora-rawhide.yml b/.github/workflows/fedora-rawhide.yml
index ec3c63d..fbcf055 100644
--- a/.github/workflows/fedora-rawhide.yml
+++ b/.github/workflows/fedora-rawhide.yml
@@ -18,15 +18,15 @@ jobs:
       matrix:
         cc: [ gcc, clang ]
     name: ${{ matrix.cc }}
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }}
     container:
       image: fedora:rawhide
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - name: Install dependencies
       run: |
-        dnf -y install git make clang cmake ninja-build autoconf automake libtool diffutils patch
+        dnf -y install git make clang cmake ninja-build autoconf automake libtool diffutils patch gawk
     - name: Pull upstream source
       run: |
         ./update.sh
diff --git a/.github/workflows/freebsd.yml b/.github/workflows/freebsd.yml
new file mode 100644
index 0000000..fe6c258
--- /dev/null
+++ b/.github/workflows/freebsd.yml
@@ -0,0 +1,71 @@
+# GitHub Actions workflow to run tests on a FreeBSD VM.
+name: "FreeBSD"
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "0 0 * * *" # At 00:00 daily.
+
+concurrency:
+  group: "${{ github.workflow }}-${{ github.event.number || github.ref }}"
+  cancel-in-progress: true
+
+env:
+  FREEBSD_VERSION: "14.1"
+
+jobs:
+  autoconf:
+    name: "autoconf"
+    runs-on: ubuntu-24.04
+    if: github.repository_owner == 'libressl' || github.event_name != 'schedule'
+    permissions:
+      contents: read
+    steps:
+      - name: "Checkout repository"
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+
+      - name: "Setup"
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y automake autoconf libtool
+          ./autogen.sh
+
+      - name: "Build on VM"
+        uses: vmactions/freebsd-vm@670398e4236735b8b65805c3da44b7a511fb8b27 # v1.3.0
+        with:
+          release: "${{ env.FREEBSD_VERSION }}"
+          copyback: false
+          prepare: |
+            pkg install -y autoconf automake libtool
+          run: |
+            ./configure
+            make -j2 check || (cat tests/test-suite.log && exit 1)
+
+  cmake:
+    name: "cmake"
+    runs-on: ubuntu-24.04
+    if: github.repository_owner == 'libressl' || github.event_name != 'schedule'
+    permissions:
+      contents: read
+    steps:
+      - name: "Checkout repository"
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
+
+      - name: "Setup"
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y automake autoconf libtool
+          ./autogen.sh
+
+      - name: "Build on VM"
+        uses: vmactions/freebsd-vm@670398e4236735b8b65805c3da44b7a511fb8b27 # v1.3.0
+        with:
+          release: "${{ env.FREEBSD_VERSION }}"
+          copyback: false
+          prepare: |
+            pkg install -y cmake ninja
+          run: |
+            export CTEST_OUTPUT_ON_FAILURE=1
+            cmake -G Ninja -B build
+            ninja -C build
+            ninja -C build test
diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index 5c85d4b..d901cf9 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -22,30 +22,40 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: ["ubuntu-20.04", "ubuntu-22.04", "ubuntu-24.04"]
+        os: ["ubuntu-22.04", "ubuntu-24.04"]
         arch: ["native", "arm32", "arm64", "mingw32", "mingw64", "mips32", "mips64"]
         compiler: ["gcc"]
         include:
-          - os: "ubuntu-20.04"
+          - os: "ubuntu-22.04"
             arch: "native"
             compiler: "clang"
-          - os: "ubuntu-22.04"
+          - os: "ubuntu-24.04"
+            arch: "native"
+            compiler: "clang"
+          - os: "ubuntu-24.04" # loong64
+            arch: "loong64"
+            compiler: "gcc"
+          - os: "ubuntu-24.04-arm"
+            arch: "native"
+            compiler: "gcc"
+          - os: "ubuntu-24.04-arm"
             arch: "native"
             compiler: "clang"
+
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: "Run tests"
-        run: ./scripts/test
+        run: ./scripts/test || (status=$?; cat tests/test-suite.log; exit $status)
         env:
           ARCH: "${{ matrix.arch }}"
           CC: "${{ matrix.compiler }}"
 
   # Test ASAN with and without ASM enabled.
   test-asan:
-    name: "ASAN (${{ matrix.asm == 'ON' && 'asm' || 'no-asm' }})"
-    runs-on: "ubuntu-latest"
+    name: "${{ matrix.os }} - ASAN (${{ matrix.asm == 'ON' && 'asm' || 'no-asm' }})"
+    runs-on: "${{ matrix.os }}"
     if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }}
     permissions:
       contents: read
@@ -53,9 +63,10 @@ jobs:
       fail-fast: false
       matrix:
         asm: [ON, OFF]
+        os: ["ubuntu-24.04", "ubuntu-24.04-arm"]
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: "Run tests"
         run: ./scripts/test
diff --git a/.github/workflows/macos.yml b/.github/workflows/macos.yml
index d5dd3eb..dad91e3 100644
--- a/.github/workflows/macos.yml
+++ b/.github/workflows/macos.yml
@@ -21,14 +21,14 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: ["macos-14", "macos-13", "macos-12"]
+        os: ["macos-15", "macos-14"]
         arch: ["arm64", "x86_64"]
     steps:
     - name: "Install required packages"
       run: brew install automake libtool
 
     - name: "Checkout repository"
-      uses: actions/checkout@v4
+      uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
     - name: "Run tests"
       run: ./scripts/test
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index c2e94b8..a20bf7d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -15,12 +15,12 @@ permissions:
 jobs:
   release:
     name: "Release"
-    runs-on: "ubuntu-latest"
+    runs-on: "ubuntu-24.04"
     outputs:
       upload_url: "${{ steps.create_release.outputs.upload_url }}"
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: "Generate version changelog"
         run: .github/scripts/changelog.sh "$VERSION" > release-changelog.txt
@@ -29,7 +29,7 @@ jobs:
 
       - name: "Create GitHub release"
         id: create_release
-        uses: softprops/action-gh-release@v1
+        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
         with:
           body_path: "${{ github.workspace }}/release-changelog.txt"
 
@@ -43,10 +43,10 @@ jobs:
         arch: [ "Win32", "x64", "ARM64" ]
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: "Setup MSYS2"
-        uses: msys2/setup-msys2@v2
+        uses: msys2/setup-msys2@4f806de0a5a7294ffabaff804b38a9b435a73bda # v2.30.0
         with:
           update: true
           install: >-
@@ -72,14 +72,10 @@ jobs:
         run: cmake --install build --config Release
 
       - shell: pwsh
-        run: Compress-Archive -Path local\* local.zip
+        run: Compress-Archive -Path local\* "libressl_${{ github.ref_name }}_windows_${{ matrix.arch }}.zip"
 
       - name: "Upload release artifact"
-        uses: actions/upload-release-asset@v1
-        env:
-          GITHUB_TOKEN: "${{ github.token }}"
+        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
         with:
-          upload_url: "${{ needs.release.outputs.upload_url }}"
-          asset_path: "local.zip"
-          asset_name: "libressl_${{ github.ref_name }}_windows_${{ matrix.arch }}.zip"
-          asset_content_type: "application/zip"
+          files: |
+            libressl_${{ github.ref_name }}_windows_${{ matrix.arch }}.zip
diff --git a/.github/workflows/rust-openssl.yml b/.github/workflows/rust-openssl.yml
index b707c4b..ed77dbb 100644
--- a/.github/workflows/rust-openssl.yml
+++ b/.github/workflows/rust-openssl.yml
@@ -13,13 +13,13 @@ concurrency:
 jobs:
   test:
     name: "Test"
-    runs-on: "ubuntu-latest"
+    runs-on: "ubuntu-24.04"
     if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }}
     permissions:
       contents: read
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: "Build LibreSSL"
         run: |
diff --git a/.github/workflows/solaris.yml b/.github/workflows/solaris.yml
index f68a2aa..a4355d0 100644
--- a/.github/workflows/solaris.yml
+++ b/.github/workflows/solaris.yml
@@ -13,13 +13,13 @@ concurrency:
 jobs:
   test:
     name: "Solaris"
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     if: ${{ github.repository_owner == 'libressl' || github.event_name != 'schedule' }}
     permissions:
       contents: read
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: "Setup"
         run: |
@@ -28,7 +28,7 @@ jobs:
           ./autogen.sh
 
       - name: "Build on VM"
-        uses: vmactions/solaris-vm@v1
+        uses: vmactions/solaris-vm@47bea106d03acaf91084e52548ee460556011602 # v1.1.8
         with:
           prepare: |
             pkg install gcc make
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 6aca153..3880a7b 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -21,20 +21,21 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: ["windows-2022", "windows-2019"]
+        os: ["windows-2022", "windows-2025"]
         arch: ["ARM64", "x64", "Win32"]
         shared: ["ON", "OFF"]
         include:
           - os: "windows-2022"
             generator: "Visual Studio 17 2022"
-          - os: "windows-2019"
-            generator: "Visual Studio 16 2019"
+          - os: "windows-2025"
+            # XXX - use appropriate value
+            generator: "Visual Studio 17 2022"
     steps:
       - name: "Checkout repository"
-        uses: actions/checkout@v4
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
 
       - name: "Setup MSYS2"
-        uses: msys2/setup-msys2@v2
+        uses: msys2/setup-msys2@4f806de0a5a7294ffabaff804b38a9b435a73bda # v2.30.0
         with:
           update: true
           install: >-
@@ -50,7 +51,7 @@ jobs:
 
       - name: "Configure CMake"
         shell: cmd
-        run: cmake -Bbuild -G "${{ matrix.generator }}" -A ${{ matrix.arch }} DBUILD_SHARED_LIBS=${{ matrix.shared }} -DCMAKE_INSTALL_PREFIX=../local
+        run: cmake -Bbuild -G "${{ matrix.generator }}" -A ${{ matrix.arch }} -D BUILD_SHARED_LIBS=${{ matrix.shared }} -D CMAKE_INSTALL_PREFIX=../local
 
       - name: "Build"
         shell: cmd
@@ -63,7 +64,7 @@ jobs:
 
       - name: "Upload build artifacts"
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: "${{ matrix.os }}-${{ matrix.arch }}${{ matrix.shared == 'ON' && '-shared' || '' }}-build-results"
           path: "build"