diff --git a/.github/workflows/pre-commit-cache.yaml b/.github/workflows/pre-commit-cache.yaml
index fec1346..23b07d7 100644
--- a/.github/workflows/pre-commit-cache.yaml
+++ b/.github/workflows/pre-commit-cache.yaml
@@ -11,6 +11,8 @@ on: # yamllint disable-line rule:truthy
 
 permissions:
   contents: write # required for trivy to upload artifacts
+  security-events: write # required for trivy to upload SARIF to GitHub Security tab (master only)
+  actions: write # required for trivy to upload SBOM artifact (master only)
 
 jobs:
   pre-commit:
@@ -31,5 +33,3 @@ jobs:
     steps:
       - name: trivy
         uses: indykite/.github/.github/actions/trivy@master
-        with:
-          github_token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index cee30b6..e360af5 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: actions/checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - https://github.com/actions/checkout/releases
+        uses: indykite/.github/.github/actions/git-checkout@master # actions/checkout with dynamic fetch-depth resolution
 
       - name: setup/python3
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 - https://github.com/actions/setup-python/releases
@@ -60,4 +60,4 @@ jobs:
         if: ${{ always() }}
         with:
           workload_identity_provider: ${{ secrets.GCP_WORKLOAD_IDENTITY_PROVIDER_MGMT }}
-          service_account: github@${{ secrets.GCP_PROJECT_ID_MGMT }}.iam.gserviceaccount.com
+          service_account: ${{ secrets.GCP_SERVICE_ACCOUNT }}
diff --git a/.github/workflows/tests.yaml b/.github/workflows/tests.yaml
index bf514e4..c6d58ff 100644
--- a/.github/workflows/tests.yaml
+++ b/.github/workflows/tests.yaml
@@ -87,7 +87,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: actions/checkout
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - https://github.com/actions/checkout/releases
+        uses: indykite/.github/.github/actions/git-checkout@master # actions/checkout with dynamic fetch-depth resolution
 
       - name: setup/python3
         uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 - https://github.com/actions/setup-python/releases
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 02c9271..8bbace2 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -21,9 +21,8 @@
 #   brew install pre-commit yamlfmt yamllint actionlint markdownlint-cli2 shellcheck shfmt trivy
 #
 # Update hooks and their dependencies regularly via:
-#   (remote) pre-commit autoupdate --jobs $(getconf _NPROCESSORS_ONLN)
+#   (remote) pre-commit autoupdate --freeze --jobs $(getconf _NPROCESSORS_ONLN)
 #   (local) brew update && brew upgrade -g
-# TODO: do NOT use '--freeze' until https://github.com/renovatebot/renovate/issues/22567 is completed
 #
 # See https://pre-commit.com for more information
 # See https://pre-commit.com/hooks.html for more hooks
@@ -44,7 +43,7 @@ repos:
         name: pre-commit/check-useless-excludes
 
   - repo: ssh://git@github.com/indykite/ops-common
-    rev: "df2a5d2660eb6f24d7d6c5edffab3c7931ae31c3" # using a branch name (or HEAD) is not supported
+    rev: "cdb88a47f18d16724ecb2f981a1d2f1b83fdacf0" # using a branch name (or HEAD) is not supported
     hooks:
       # POST-CHECKOUT
       # install explicitly with: pre-commit install -t post-checkout
@@ -67,7 +66,7 @@ repos:
   #
   # Renovate
   - repo: https://github.com/renovatebot/pre-commit-hooks # ci:ignore:OK to validate locally only, otherwise it adds 850MB+ to unpacked cache
-    rev: "43.285.6"
+    rev: "3e092534a50de9c02837a60a96f6d52eea931033" # frozen: 43.285.7
     hooks:
       - id: renovate-config-validator
         args: [--strict]
@@ -75,7 +74,7 @@ repos:
   #
   # Commit Message linting
   - repo: https://github.com/alessandrojcm/commitlint-pre-commit-hook # ci:ignore:executed under a separate GitHub action
-    rev: v9.26.0
+    rev: 25d0a52aa8bc0fc242613346792dc8d726c13347 # frozen: v9.26.0
     hooks:
       # NON-DEFAULT stage, install explicitly with: pre-commit install -t commit-msg
       - id: commitlint
@@ -89,7 +88,7 @@ repos:
 
   #
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v6.0.0
+    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # frozen: v6.0.0
     hooks:
       # Git style
       - id: check-added-large-files
@@ -152,7 +151,7 @@ repos:
   #
   # more Python
   - repo: https://github.com/abravalheri/validate-pyproject
-    rev: v0.25
+    rev: 4b2e70d08cb2ccd26d1fba73588de41c7a5d50b7 # frozen: v0.25
     hooks:
       - id: validate-pyproject
         name: python-validate-pyproject
@@ -176,7 +175,7 @@ repos:
 
   # #
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.16.0
+    rev: cb8c523fd4835aba42af70f4cad5568db4df0b6c # frozen: v0.16.0
     hooks:
       - id: ruff-format
         name: python-ruff-format
@@ -185,7 +184,7 @@ repos:
         args: [--fix] # enable autofixes
 
   - repo: https://github.com/PyCQA/bandit
-    rev: 1.9.4
+    rev: 92ae8b82fb422a639f0ed8d99e96cea769594e08 # frozen: 1.9.4
     hooks:
       - id: bandit
         name: python-bandit
@@ -193,21 +192,21 @@ repos:
         additional_dependencies: ["bandit[toml]"]
 
   - repo: https://github.com/PyCQA/pylint
-    rev: v4.0.6
+    rev: 8a396357098337ba8be714fffdf2d00947a9778c # frozen: v4.0.6
     hooks:
       - id: pylint
         name: pylint
         stages: [manual] # TODO: fix findings
 
   - repo: https://github.com/PyCQA/isort # ci:ignore:manual stage only
-    rev: 8.0.1
+    rev: 7f321d375f31a2f03833bc9a548e8783f2b5c420 # frozen: 9.0.0b1
     hooks:
       - id: isort
         name: python-isort
         stages: [manual] # XXX: not used by default, but left as a reference
 
   - repo: https://github.com/PyCQA/flake8 # ci:ignore:manual stage only
-    rev: 7.3.0
+    rev: d93590f5be797aabb60e3b09f2f52dddb02f349f # frozen: 7.3.0
     hooks:
       - id: flake8
         name: python-flake8
@@ -216,7 +215,7 @@ repos:
 
   - repo: https://github.com/psf/black-pre-commit-mirror # ci:ignore:manual stage only
     # Using this mirror lets us use mypyc-compiled black, which is about 2x faster
-    rev: 26.5.1
+    rev: 4160603246a6b365d4a2af661c6d71b0a0f50478 # frozen: 26.5.1
     hooks:
       - id: black
         # It is recommended to specify the latest version of Python supported by the project
@@ -225,7 +224,7 @@ repos:
         stages: [manual] # XXX: not used by default, but left as a reference
 
   - repo: https://github.com/pre-commit/mirrors-mypy # ci:ignore:manual stage only
-    rev: v2.3.0
+    rev: 41e691678310dfd3833f7ab4e180ddb014310356 # frozen: v2.3.0
     hooks:
       - id: mypy
         name: python-mypy
@@ -235,7 +234,7 @@ repos:
   #
   # Detect hardcoded secrets
   - repo: https://github.com/gitleaks/gitleaks
-    rev: v8.30.1
+    rev: 2ca41cc1372d1e939a6a879f18cdc19fc1cac1ce # frozen: v8.30.0
     hooks:
       - id: gitleaks
         name: gitleaks
diff --git a/.trivy.yaml b/.trivy.yaml
index a2859af..520991d 100644
--- a/.trivy.yaml
+++ b/.trivy.yaml
@@ -35,6 +35,7 @@ scan:
     - misconfig
   skip-dirs: ["**/.terraform/**", "**/.terragrunt-cache/**", "openapi/**"]
   # skip-files: []
+  show-suppressed: true
 
 vulnerability:
   ignore-unfixed: false
@@ -53,5 +54,3 @@ misconfiguration:
 
   terraform:
     exclude-downloaded-modules: true
-
-# TODO: add licensing restrictions, https://trivy.dev/latest/docs/references/configuration/config-file/#license-options