diff --git a/.github/actions/setup-go/action.yml b/.github/actions/setup-go/action.yml
index 9820b20..ed7046f 100644
--- a/.github/actions/setup-go/action.yml
+++ b/.github/actions/setup-go/action.yml
@@ -7,7 +7,7 @@ inputs:
 runs:
   using: composite
   steps:
-    - uses: stainless-api/retrieve-github-access-token@v1
+    - uses: stainless-api/retrieve-github-access-token@1f03f929b746c5b03dcdafa2bebbb18ca5672e1a # v1.0.0
       if: github.repository == 'stainless-sdks/deeptable-cli'
       id: get_token
       with:
@@ -20,7 +20,7 @@ runs:
       run: git config --global url."https://x-access-token:${{ steps.get_token.outputs.github_access_token }}@github.com/stainless-sdks/deeptable-go".insteadOf "https://github.com/stainless-sdks/deeptable-go"
 
     - name: Setup go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
       with:
         go-version-file: ./go.mod
 
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ec5e177..36cc7ad 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,7 +25,7 @@ jobs:
     if: (github.event_name == 'push' || github.event.pull_request.head.repo.fork) && (github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata')
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - uses: ./.github/actions/setup-go
         with:
@@ -51,7 +51,7 @@ jobs:
     runs-on: ${{ github.repository == 'stainless-sdks/deeptable-cli' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
     if: (github.event_name == 'push' || github.event.pull_request.head.repo.fork) && (github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata')
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - uses: ./.github/actions/setup-go
         with:
@@ -66,7 +66,7 @@ jobs:
         run: ./scripts/bootstrap
 
       - name: Run goreleaser
-        uses: goreleaser/goreleaser-action@v6.1.0
+        uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6.1.0
         with:
           version: latest
           args: release --snapshot --clean --skip=publish
@@ -78,7 +78,7 @@ jobs:
           github.repository == 'stainless-sdks/deeptable-cli' &&
           !startsWith(github.ref, 'refs/heads/stl/')
         id: github-oidc
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: core.setOutput('github_token', await core.getIDToken());
 
@@ -98,7 +98,7 @@ jobs:
     runs-on: ${{ github.repository == 'stainless-sdks/deeptable-cli' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
     if: github.event_name == 'push' || github.event.pull_request.head.repo.fork
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - uses: ./.github/actions/setup-go
         with:
diff --git a/.github/workflows/publish-release.yml b/.github/workflows/publish-release.yml
index 0858063..6b026e0 100644
--- a/.github/workflows/publish-release.yml
+++ b/.github/workflows/publish-release.yml
@@ -16,15 +16,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
         fetch-depth: 0
     - name: Set up Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
       with:
         go-version-file: "go.mod"
     - name: Run GoReleaser
-      uses: goreleaser/goreleaser-action@v6.1.0
+      uses: goreleaser/goreleaser-action@9ed2f89a662bf1735a48bc8557fd212fa902bebf # v6.1.0
       with:
         version: latest
         args: release --clean
diff --git a/.github/workflows/release-doctor.yml b/.github/workflows/release-doctor.yml
index 568d939..4db7071 100644
--- a/.github/workflows/release-doctor.yml
+++ b/.github/workflows/release-doctor.yml
@@ -12,7 +12,7 @@ jobs:
     if: github.repository == 'deeptable-com/deeptable-cli' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'release-please') || github.head_ref == 'next')
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Check release environment
         run: |
diff --git a/.release-please-manifest.json b/.release-please-manifest.json
index bf7fe4f..ce692f9 100644
--- a/.release-please-manifest.json
+++ b/.release-please-manifest.json
@@ -1,3 +1,3 @@
 {
-  ".": "0.1.0-beta.3"
+  ".": "0.1.0-beta.4"
 }
\ No newline at end of file
diff --git a/.stats.yml b/.stats.yml
index ab1ff83..d385add 100644
--- a/.stats.yml
+++ b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 14
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/deeptable/deeptable-acfb7545d19701827292fc4663c6852d423dd84e65639e5b7ed766dc2d01aff2.yml
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/deeptable/deeptable-c2ba6ef00d2555562de924d59cd80aff8aa7b117580b1d89c5327e622896c7e2.yml
 openapi_spec_hash: 9f090892f01aa7afe4f22910c41b911b
 config_hash: 56ee7b575c6a6e90046a0f807e5f3234
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8149c9a..17d0389 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.1.0-beta.4 (2026-05-13)
+
+Full Changelog: [v0.1.0-beta.3...v0.1.0-beta.4](https://github.com/deeptable-com/deeptable-cli/compare/v0.1.0-beta.3...v0.1.0-beta.4)
+
+### Chores
+
+* redact api-key headers in debug logs ([3ab4a2e](https://github.com/deeptable-com/deeptable-cli/commit/3ab4a2e51a52b1650a909eed9ba330d5357325ec))
+
 ## 0.1.0-beta.3 (2026-04-30)
 
 Full Changelog: [v0.1.0-beta.2...v0.1.0-beta.3](https://github.com/deeptable-com/deeptable-cli/compare/v0.1.0-beta.2...v0.1.0-beta.3)
diff --git a/internal/debugmiddleware/debug_middleware.go b/internal/debugmiddleware/debug_middleware.go
index f07b93b..647f1de 100644
--- a/internal/debugmiddleware/debug_middleware.go
+++ b/internal/debugmiddleware/debug_middleware.go
@@ -21,7 +21,12 @@ const redactedPlaceholder = "<REDACTED>"
 
 // Headers known to contain sensitive information like an API key. Note that this exclude `Authorization`,
 // which is handled specially in `redactRequest` below.
-var sensitiveHeaders = []string{}
+var sensitiveHeaders = []string{
+	"api-key",
+	"x-api-key",
+	"cookie",
+	"set-cookie",
+}
 
 // RequestLogger is a middleware that logs HTTP requests and responses.
 type RequestLogger struct {
diff --git a/pkg/cmd/version.go b/pkg/cmd/version.go
index bc12c38..424bd7b 100644
--- a/pkg/cmd/version.go
+++ b/pkg/cmd/version.go
@@ -2,4 +2,4 @@
 
 package cmd
 
-const Version = "0.1.0-beta.3" // x-release-please-version
+const Version = "0.1.0-beta.4" // x-release-please-version