diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1171e85..23b2ba5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -23,10 +23,17 @@ jobs:
           - os: macos-latest
             docker_tests_flags: "--no-default-features"
     steps:
-      - uses: actions/checkout@v4
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+
+      # selecting a toolchain either by action or manual `rustup` happen
+      # before cache setup
+      - run: rustup toolchain install stable --profile minimal
+
+      - name: Set up rust cache
+        uses: Swatinem/rust-cache@c19371144df3bb44fab255c43d04cbc2ab54d1c4 # v2.9.1
         with:
-          targets: "wasm32-wasip1"
+          save-if: ${{ github.ref == 'refs/heads/main' }}
+
 
       - name: Run lints
         if: matrix.run_lints
diff --git a/.github/workflows/publish-binaries.yml b/.github/workflows/publish-binaries.yml
index b519f24..ae8a93f 100644
--- a/.github/workflows/publish-binaries.yml
+++ b/.github/workflows/publish-binaries.yml
@@ -48,7 +48,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Install Rust
         run: rustup update stable --no-self-update && rustup default stable && rustup target add ${{ matrix.rust-target }}
       - run: cargo build --release --target ${{ matrix.rust-target }}
@@ -104,7 +104,7 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Install Rust
         run: rustup update stable --no-self-update && rustup default stable && rustup target add ${{ matrix.rust-target }}
       - run: cargo build --release --target ${{ matrix.rust-target }}
@@ -129,7 +129,7 @@ jobs:
     env:
       CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Install Rust
         run: rustup update stable --no-self-update && rustup default stable
       - name: Publish wasm-pkg-common
diff --git a/rust-toolchain.toml b/rust-toolchain.toml
new file mode 100644
index 0000000..88a12d5
--- /dev/null
+++ b/rust-toolchain.toml
@@ -0,0 +1,3 @@
+[toolchain]
+channel = "stable"
+targets = ["wasm32-wasip1"]