diff --git a/.github/commitsar.yml b/.commitsar.yaml
similarity index 100%
rename from .github/commitsar.yml
rename to .commitsar.yaml
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 17a5421..98f2f58 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -24,10 +24,12 @@ jobs:
         composer-deps: [lowest, stable]
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@accd6127cb78bee3e8082180cb391013d204ef9f # 2.37.0
         with:
           coverage: none
           php-version: ${{ matrix.php-version }}
diff --git a/.github/workflows/pr-conventions.yml b/.github/workflows/pr-conventions.yml
index c2c6ceb..8181bcd 100644
--- a/.github/workflows/pr-conventions.yml
+++ b/.github/workflows/pr-conventions.yml
@@ -3,22 +3,25 @@ name: "conventions"
 on:
   pull_request: ~
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   lint:
     name: Validate PR and commits
     runs-on: ubuntu-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Validate commits
-        uses: docker://aevea/commitsar
-        env:
-          COMMITSAR_CONFIG_PATH: .github/commitsar.yml
+        uses: aevea/commitsar@909c3ab676c9af63cb84f2e38f395c7e89829b04 # v1.0.3
 
       - name: Validate pull request title
-        uses: amannn/action-semantic-pull-request@v6
+        uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/pr-labeler.yml b/.github/workflows/pr-labeler.yml
index 8a8f608..45efcb8 100644
--- a/.github/workflows/pr-labeler.yml
+++ b/.github/workflows/pr-labeler.yml
@@ -12,7 +12,7 @@ jobs:
   content-label:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/labeler@v6
+      - uses: actions/labeler@634933edcd8ababfe52f92936142cc22ac488b1b # v6.0.1
         with:
           sync-labels: true
 
@@ -20,7 +20,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 5
     steps:
-      - uses: bcoe/conventional-release-labels@v1
+      - uses: bcoe/conventional-release-labels@886f696738527c7be444262c327c89436dfb95a8 # v1.3.1
         with:
           type_labels: |
             {
diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index 21d7978..ccc970e 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -13,7 +13,7 @@ jobs:
   release-please:
     runs-on: ubuntu-latest
     steps:
-      - uses: googleapis/release-please-action@v4
+      - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4.4.0
         with:
           release-type: php
           token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/README.md b/README.md
index cdb78f4..1df1df1 100644
--- a/README.md
+++ b/README.md
@@ -1,3 +1,7 @@
+<p align="center">
+  <img src="docs/logo.png" alt="Messenger Logging Bundle logo" width="240">
+</p>
+
 # Messenger Logging Bundle
 
 Symfony bundle for Messenger lifecycle logging, suitable for monitoring.
diff --git a/docs/logo.png b/docs/logo.png
new file mode 100644
index 0000000..a78b3d7
Binary files /dev/null and b/docs/logo.png differ