diff --git a/.github/workflows/actions.lock b/.github/workflows/actions.lock
new file mode 100644
index 000000000..84159b132
--- /dev/null
+++ b/.github/workflows/actions.lock
@@ -0,0 +1,123 @@
+# This file is machine-generated by `gh actions-lock`.
+# Do not edit by hand; run `gh actions-lock` to update.
+# Docs: https://gh.io/actions-lockfile
+version: 'v0.0.2'
+workflows:
+    '.github/workflows/bench.yml':
+        - 'actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0'
+    '.github/workflows/ci-post-merge.yml':
+        - 'actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6'
+        - 'actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0'
+        - 'ilammy/setup-nasm@72793074d3c8cdda771dba85f6deafe00623038b'
+        - 'rui314/setup-mold@9c9c13bf4c3f1adef0cc596abc155580bcb04444'
+        - 'taiki-e/install-action@9e1e5806d4a4822de933115878265be9aaa786d9'
+    '.github/workflows/ci.yml':
+        - 'actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6'
+        - 'actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0'
+        - 'embarkstudios/cargo-deny-action@bb137d7af7e4fb67e5f82a49c4fce4fad40782fe'
+        - 'ilammy/setup-nasm@72793074d3c8cdda771dba85f6deafe00623038b'
+        - 'rui314/setup-mold@9c9c13bf4c3f1adef0cc596abc155580bcb04444'
+        - 'taiki-e/install-action@9e1e5806d4a4822de933115878265be9aaa786d9'
+    '.github/workflows/coverage.yml':
+        - 'actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6'
+        - 'actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0'
+        - 'codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f'
+        - 'taiki-e/install-action@9e1e5806d4a4822de933115878265be9aaa786d9'
+    '.github/workflows/labeler.yml':
+        - 'actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0'
+        - 'actions/labeler@f27b608878404679385c85cfa523b85ccb86e213'
+    '.github/workflows/lint.yml':
+        - 'actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6'
+        - 'actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0'
+        - 'giraffate/clippy-action@13b9d32482f25d29ead141b79e7e04e7900281e0'
+        - 'taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7'
+        - 'taiki-e/install-action@9e1e5806d4a4822de933115878265be9aaa786d9'
+        - 'zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa'
+    '.github/workflows/semver-checks.yml':
+        - 'actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6'
+        - 'actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0'
+        - 'taiki-e/install-action@9e1e5806d4a4822de933115878265be9aaa786d9'
+dependencies:
+    'actions-rust-lang/setup-rust-toolchain@46268bd060767258de96ed93c1251119784f2ab6':
+        ref: 'v1.16.1'
+        commit: 'sha1-46268bd060767258de96ed93c1251119784f2ab6'
+        owner_id: 103899579
+        repo_id: 482610590
+        uses:
+            - 'swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4'
+    'actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae':
+        ref: 'v5.0.5'
+        commit: 'sha1-27d5ce7f107fe9357f9df03efb73ab90386fccae'
+        owner_id: 44036562
+        repo_id: 215566462
+    'actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0':
+        ref: 'v7.0.0'
+        commit: 'sha1-9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0'
+        owner_id: 44036562
+        repo_id: 197814629
+    'actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd':
+        ref: 'v8.0.0'
+        commit: 'sha1-ed597411d8f924073f98dfc5c65a23a2325f34cd'
+        owner_id: 44036562
+        repo_id: 205262760
+    'actions/labeler@f27b608878404679385c85cfa523b85ccb86e213':
+        ref: 'v6.1.0'
+        commit: 'sha1-f27b608878404679385c85cfa523b85ccb86e213'
+        owner_id: 44036562
+        repo_id: 177139928
+    'codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f':
+        ref: 'v7.0.0'
+        commit: 'sha1-fb8b3582c8e4def4969c97caa2f19720cb33a72f'
+        owner_id: 8226205
+        repo_id: 200299178
+        uses:
+            - 'actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd'
+    'embarkstudios/cargo-deny-action@bb137d7af7e4fb67e5f82a49c4fce4fad40782fe':
+        ref: 'v2.0.20'
+        commit: 'sha1-bb137d7af7e4fb67e5f82a49c4fce4fad40782fe'
+        owner_id: 44887257
+        repo_id: 228054692
+    'giraffate/clippy-action@13b9d32482f25d29ead141b79e7e04e7900281e0':
+        ref: 'v1.0.1'
+        commit: 'sha1-13b9d32482f25d29ead141b79e7e04e7900281e0'
+        owner_id: 17407489
+        repo_id: 560300269
+    'github/codeql-action@8aad20d150bbac5944a9f9d289da16a4b0d87c1e':
+        ref: 'v4.36.2'
+        commit: 'sha1-8aad20d150bbac5944a9f9d289da16a4b0d87c1e'
+        owner_id: 9919
+        repo_id: 259445878
+    'ilammy/setup-nasm@72793074d3c8cdda771dba85f6deafe00623038b':
+        ref: 'v1.5.2'
+        commit: 'sha1-72793074d3c8cdda771dba85f6deafe00623038b'
+        owner_id: 1256587
+        repo_id: 211647646
+    'rui314/setup-mold@9c9c13bf4c3f1adef0cc596abc155580bcb04444':
+        ref: 'v1'
+        commit: 'sha1-9c9c13bf4c3f1adef0cc596abc155580bcb04444'
+        owner_id: 47400
+        repo_id: 479867630
+    'swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4':
+        ref: 'v2.9.1'
+        commit: 'sha1-c19371144df3bb44fab255c43d04cbc2ab54d1c4'
+        owner_id: 580492
+        repo_id: 298565987
+    'taiki-e/cache-cargo-install-action@417450f3c33ee20393705369577571770643d4c7':
+        ref: 'v3.0.7'
+        commit: 'sha1-417450f3c33ee20393705369577571770643d4c7'
+        owner_id: 43724913
+        repo_id: 588643148
+        uses:
+            - 'actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae'
+    'taiki-e/install-action@9e1e5806d4a4822de933115878265be9aaa786d9':
+        ref: 'v2.82.2'
+        commit: 'sha1-9e1e5806d4a4822de933115878265be9aaa786d9'
+        owner_id: 43724913
+        repo_id: 442947557
+    'zizmorcore/zizmor-action@192e21d79ab29983730a13d1382995c2307fbcaa':
+        ref: 'v0.5.7'
+        commit: 'sha1-192e21d79ab29983730a13d1382995c2307fbcaa'
+        owner_id: 210636713
+        repo_id: 985558803
+        uses:
+            - 'github/codeql-action@8aad20d150bbac5944a9f9d289da16a4b0d87c1e'
diff --git a/.github/workflows/bench.yml b/.github/workflows/bench.yml
index e54d8a618..da9c5f7f4 100644
--- a/.github/workflows/bench.yml
+++ b/.github/workflows/bench.yml
@@ -1,3 +1,5 @@
+# This workflow is managed by gh actions-lock.
+
 name: Benchmark
 
 on:
diff --git a/.github/workflows/ci-post-merge.yml b/.github/workflows/ci-post-merge.yml
index b4bb756c1..4a10cc757 100644
--- a/.github/workflows/ci-post-merge.yml
+++ b/.github/workflows/ci-post-merge.yml
@@ -1,3 +1,5 @@
+# This workflow is managed by gh actions-lock.
+
 name: CI (post-merge)
 
 on:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 882331700..afa7e5bd4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,3 +1,5 @@
+# This workflow is managed by gh actions-lock.
+
 name: CI
 
 on:
diff --git a/.github/workflows/coverage.yml b/.github/workflows/coverage.yml
index 54abba272..2fe5b6390 100644
--- a/.github/workflows/coverage.yml
+++ b/.github/workflows/coverage.yml
@@ -1,3 +1,5 @@
+# This workflow is managed by gh actions-lock.
+
 name: Coverage
 
 on:
diff --git a/.github/workflows/labeler.yml b/.github/workflows/labeler.yml
index 882288605..c83073f4b 100644
--- a/.github/workflows/labeler.yml
+++ b/.github/workflows/labeler.yml
@@ -1,6 +1,9 @@
+# This workflow is managed by gh actions-lock.
+
 name: Labeler
 
-on:
+# This is for labeling, permissions are restricted.
+on: # zizmor: ignore[dangerous-triggers]
   pull_request_target:
     types: [opened, synchronize, reopened]
 
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 463ea63e6..0d5413518 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -1,3 +1,5 @@
+# This workflow is managed by gh actions-lock.
+
 name: Lint
 
 on:
diff --git a/.github/workflows/semver-checks.yml b/.github/workflows/semver-checks.yml
index 27c266fc4..55b8f628b 100644
--- a/.github/workflows/semver-checks.yml
+++ b/.github/workflows/semver-checks.yml
@@ -1,3 +1,5 @@
+# This workflow is managed by gh actions-lock.
+
 name: Semver Checks
 
 on: